Skip to content

Commit 9232845

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2qqc-p94c-hxwh GHSA-9hrv-gvrv-6gf2 GHSA-cc4f-hjpj-g9p8 GHSA-m7mq-85xj-9x33 GHSA-qqvm-66q4-vf5c GHSA-w6v6-49gh-mc9w
1 parent 8af2ed4 commit 9232845

File tree

6 files changed

+414
-0
lines changed

6 files changed

+414
-0
lines changed

‎advisories/github-reviewed/2026/04/GHSA-2qqc-p94c-hxwh/GHSA-2qqc-p94c-hxwh.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2qqc-p94c-hxwh",
4+
"modified": "2026-04-16T21:22:00Z",
5+
"published": "2026-04-16T21:22:00Z",
6+
"aliases": [],
7+
"summary": "Flowise: Weak Default Express Session Secret",
8+
"details": "**Detection Method:** Kolega.dev Deep Code Scan\n\n| Attribute | Value |\n|---|---|\n| Location | packages/server/src/enterprise/middleware/passport/index.ts:55 |\n| Practical Exploitability | High |\n| Developer Approver | faizan@kolega.ai |\n\n### Description\nExpress session secret has a weak default value 'flowise' when EXPRESS_SESSION_SECRET is not set.\n\n### Affected Code\n```\nsecret: process.env.EXPRESS_SESSION_SECRET || 'flowise'\n```\n\n### Evidence\nThe default session secret 'flowise' is publicly visible and weak. Session cookies signed with this secret can be forged by attackers.\n\n### Impact\nSession hijacking and forgery - attackers can create arbitrary session cookies to impersonate any user, bypassing all authentication mechanisms.\n\n### Recommendation\nRequire EXPRESS_SESSION_SECRET to be set with a strong random value. Throw an error on startup if not configured. Use cryptographically strong random strings (minimum 256 bits).\n\n### Notes\nThe Express session secret defaults to the string 'flowise' when EXPRESS_SESSION_SECRET is not set (line 55). This secret is used to sign session cookies via express-session middleware. Since 'flowise' is publicly visible in the source code, an attacker can forge valid session cookies to impersonate any user without authentication. The .env.example file has this commented out (# EXPRESS_SESSION_SECRET=flowise), implying it's optional, which compounds the risk. Unlike development-only defaults, this code path is active in production if the environment variable is not set. The application should require EXPRESS_SESSION_SECRET to be explicitly configured with a cryptographically strong random value and fail to start otherwise.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "flowise"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "3.1.0"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 3.0.13"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2qqc-p94c-hxwh"
43+
},
44+
{
45+
"type": "PACKAGE",
46+
"url": "https://github.com/FlowiseAI/Flowise"
47+
}
48+
],
49+
"database_specific": {
50+
"cwe_ids": [
51+
"CWE-798"
52+
],
53+
"severity": "MODERATE",
54+
"github_reviewed": true,
55+
"github_reviewed_at": "2026-04-16T21:22:00Z",
56+
"nvd_published_at": null
57+
}
58+
}

‎advisories/github-reviewed/2026/04/GHSA-9hrv-gvrv-6gf2/GHSA-9hrv-gvrv-6gf2.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9hrv-gvrv-6gf2",
4+
"modified": "2026-04-16T21:23:18Z",
5+
"published": "2026-04-16T21:23:17Z",
6+
"aliases": [],
7+
"summary": "Flowise Execute Flow function has an SSRF vulnerability",
8+
"details": "### Summary\n\nThe attacker provides an intranet address through the base url field configured in the Execute Flow node \n→ Bypass checkDenyList / resolveAndValidate in httpSecurity.ts (not called)\n→ Causes the server to initiate an HTTP request to any internal network address, read cloud metadata, or detect internal network services \n\n### Details\n\n<img width=\"1280\" height=\"860\" alt=\"9a52a74e6fe2fd78e4962d1d68057fc2\" src=\"https://github.com/user-attachments/assets/20df0006-9129-4886-8928-16d19a617c23\" />\n\nThen initiate the call: \n\n```\nPOST /api/v1/prediction/d6739838-d3b3-43d9-86ff-911a3d757a7e HTTP/1.1\nHost: 127.0.0.1:3000\nContent-Type: application/json\nAuthorization: Bearer apikey\nContent-Length: 17\n\n{\"question\": \"1\"}\n```\n\nServer received a request:\n\n<img width=\"1432\" height=\"172\" alt=\"f45c757fec408e13739db068252ff21b\" src=\"https://github.com/user-attachments/assets/d3dfe0f5-83ec-4c79-ab32-754382a68d5f\" />\n\nAnd there is an echo: \n\n<img width=\"1280\" height=\"666\" alt=\"fa0caf0deb306cfeeea8fdf8941a287e\" src=\"https://github.com/user-attachments/assets/55a94d25-120b-4e9c-9517-46c2fc2b667f\" />\n\nFix:\nCall secureFetch for verification\n\n\n\n### Impact\n\nThis is a Server-Side Request Forgery (SSRF) vulnerability that may lead to the following risks: \n- Explore Internal Web Applications\n- Access sensitive management interfaces\n- Leak internal configuration, credentials, or confidential information\n\nThis vulnerability significantly increases the risk of internal service enumeration and potential lateral movement in enterprise environments.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "flowise"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "3.1.0"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 3.0.13"
36+
}
37+
},
38+
{
39+
"package": {
40+
"ecosystem": "npm",
41+
"name": "flowise-components"
42+
},
43+
"ranges": [
44+
{
45+
"type": "ECOSYSTEM",
46+
"events": [
47+
{
48+
"introduced": "0"
49+
},
50+
{
51+
"fixed": "3.1.0"
52+
}
53+
]
54+
}
55+
],
56+
"database_specific": {
57+
"last_known_affected_version_range": "<= 3.0.13"
58+
}
59+
}
60+
],
61+
"references": [
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9hrv-gvrv-6gf2"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/FlowiseAI/Flowise"
69+
}
70+
],
71+
"database_specific": {
72+
"cwe_ids": [
73+
"CWE-918"
74+
],
75+
"severity": "MODERATE",
76+
"github_reviewed": true,
77+
"github_reviewed_at": "2026-04-16T21:23:17Z",
78+
"nvd_published_at": null
79+
}
80+
}

‎advisories/github-reviewed/2026/04/GHSA-cc4f-hjpj-g9p8/GHSA-cc4f-hjpj-g9p8.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cc4f-hjpj-g9p8",
4+
"modified": "2026-04-16T21:21:12Z",
5+
"published": "2026-04-16T21:21:12Z",
6+
"aliases": [],
7+
"summary": "Flowise: Weak Default JWT Secrets",
8+
"details": "**Detection Method:** Kolega.dev Deep Code Scan\n\n| Attribute | Value |\n|---|---|\n| Severity | Critical |\n| Location | packages/server/src/enterprise/middleware/passport/index.ts:29-34 |\n| Practical Exploitability | High |\n| Developer Approver | faizan@kolega.ai |\n\n### Description\nJWT secrets have weak hardcoded defaults ('auth_token', 'refresh_token', 'AUDIENCE', 'ISSUER'). Attackers can forge valid JWTs and impersonate any user.\n\n### Affected Code\n```\nconst jwtAudience = process.env.JWT_AUDIENCE || 'AUDIENCE'\nconst jwtIssuer = process.env.JWT_ISSUER || 'ISSUER'\nconst jwtAuthTokenSecret = process.env.JWT_AUTH_TOKEN_SECRET || 'auth_token'\nconst jwtRefreshSecret = process.env.JWT_REFRESH_TOKEN_SECRET || process.env.JWT_AUTH_TOKEN_SECRET || 'refresh_token'\n```\n\n### Evidence\nAll JWT defaults are weak strings. Refresh token falls back to auth token which is a design flaw. If any environment variable is unset, weak default is used.\n\n### Impact\nComplete authentication bypass. Attackers can forge valid JWTs for any user account. No authentication required to access protected endpoints. Can escalate to admin access.\n\n### Recommendation\nRemove all default secrets - require all JWT environment variables to be explicitly set. Add startup validation throwing error if any JWT secret is missing. Use cryptographically random secrets (256+ bits) for each secret independently. Implement JWT secret rotation mechanism.\n\n### Notes\nThe JWT secrets have genuinely weak hardcoded defaults ('auth_token', 'refresh_token', 'AUDIENCE', 'ISSUER') at lines 29-34. If an administrator deploys without setting the environment variables JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, and JWT_ISSUER, the application will use these trivially guessable values. An attacker knowing these defaults (which are publicly visible in the source code) can forge valid JWTs to impersonate any user, including administrators. The fallback chain at line 34 where jwtRefreshSecret falls back to jwtAuthTokenSecret is an additional design weakness - if only JWT_AUTH_TOKEN_SECRET is set, both tokens share the same secret. While .env.example files provide placeholder values, these are also weak and publicly visible. The application should fail to start if these secrets are not explicitly configured with strong values, rather than silently falling back to insecure defaults.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "flowise"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "3.1.0"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 3.0.13"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cc4f-hjpj-g9p8"
43+
},
44+
{
45+
"type": "PACKAGE",
46+
"url": "https://github.com/FlowiseAI/Flowise"
47+
}
48+
],
49+
"database_specific": {
50+
"cwe_ids": [
51+
"CWE-327"
52+
],
53+
"severity": "MODERATE",
54+
"github_reviewed": true,
55+
"github_reviewed_at": "2026-04-16T21:21:12Z",
56+
"nvd_published_at": null
57+
}
58+
}

‎advisories/github-reviewed/2026/04/GHSA-m7mq-85xj-9x33/GHSA-m7mq-85xj-9x33.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m7mq-85xj-9x33",
4+
"modified": "2026-04-16T21:22:36Z",
5+
"published": "2026-04-16T21:22:36Z",
6+
"aliases": [],
7+
"summary": "Flowise: Weak Default Token Hash Secret",
8+
"details": "**Detection Method:** Kolega.dev Deep Code Scan\n\n| Attribute | Value |\n|---|---|\n| Location | packages/server/src/enterprise/utils/tempTokenUtils.ts:31-34 |\n| Practical Exploitability | Medium |\n| Developer Approver | faizan@kolega.ai |\n\n### Description\nThe encryption key for token encryption has a weak default value 'Secre$t' when TOKEN_HASH_SECRET environment variable is not set.\n\n### Affected Code\n```\nconst key = crypto\n .createHash('sha256')\n .update(process.env.TOKEN_HASH_SECRET || 'Secre$t')\n .digest()\n```\n\n### Evidence\nThe default value 'Secre$t' is hardcoded in the source code and is cryptographically weak. This key is used to encrypt user IDs and workspace IDs in JWT tokens.\n\n### Impact\nToken forgery - attackers can decrypt and manipulate encrypted token metadata, potentially changing user IDs or workspace IDs to escalate privileges or access unauthorized data.\n\n### Recommendation\nRequire TOKEN_HASH_SECRET to be set as a strong random value in environment variables. Throw an error on startup if not configured. Use a minimum of 32 bytes of entropy.\n\n### Notes\nThe TOKEN_HASH_SECRET has a weak hardcoded default 'Secre$t' (lines 31-34 and 50-53). This secret is used to derive an AES-256-CBC encryption key for encrypting sensitive metadata (user ID and workspace ID) embedded in JWT tokens via encryptToken() called at line 394 of passport/index.ts. If TOKEN_HASH_SECRET is not configured, an attacker knowing the default can decrypt the 'meta' field in JWTs to extract user IDs and workspace IDs. While this alone doesn't grant access (the JWT signature is separate), it leaks internal identifiers that could aid other attacks. The .env.example shows '# TOKEN_HASH_SECRET='popcorn'' - another weak value, and it's commented out suggesting it's optional. The application should require this secret to be explicitly set with a strong random value.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "flowise"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "3.1.0"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 3.0.13"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-m7mq-85xj-9x33"
43+
},
44+
{
45+
"type": "PACKAGE",
46+
"url": "https://github.com/FlowiseAI/Flowise"
47+
}
48+
],
49+
"database_specific": {
50+
"cwe_ids": [
51+
"CWE-798"
52+
],
53+
"severity": "MODERATE",
54+
"github_reviewed": true,
55+
"github_reviewed_at": "2026-04-16T21:22:36Z",
56+
"nvd_published_at": null
57+
}
58+
}

‎advisories/github-reviewed/2026/04/GHSA-qqvm-66q4-vf5c/GHSA-qqvm-66q4-vf5c.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qqvm-66q4-vf5c",
4+
"modified": "2026-04-16T21:23:03Z",
5+
"published": "2026-04-16T21:23:03Z",
6+
"aliases": [],
7+
"summary": "Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)",
8+
"details": "### Summary\n\nFlowise introduced SSRF protections through a centralized HTTP security wrapper (`httpSecurity.ts`) that implements deny-list validation and IP pinning logic.\n\nHowever, multiple tool implementations directly import and invoke raw HTTP clients (`node-fetch`, `axios`Instead of using the secured wrapper.\n\nBecause enforcement is neither mandatory nor centralized, these tools bypass SSRF mitigation entirely, restoring full SSRF capability even after the patch.\n\nThis issue is distinct from specification trust issues and represents incomplete mitigation of previously addressed SSRF vulnerabilities.\n\n### Details\n**Intended Security Model:**\n\nAll outbound HTTP requests should pass through the centralized validation layer implemented in:\n\n```\npackages/components/src/httpSecurity.ts\n```\n\nThis layer performs:\n\n- `HTTP_DENY_LIST` enforcement\n- IP resolution validation\n- IP pinning\n- Loopback blocking\n\n**Observed Implementation Gap:**\n\nMultiple tools bypass this layer and import HTTP libraries directly.\n\nExamples include:\n\n- `packages/components/nodes/tools/OpenAPIToolkit/OpenAPIToolkit.ts`\n- `packages/components/nodes/tools/WebScraperTool/WebScraperTool.ts`\n- `packages/components/nodes/tools/MCP/core.ts`\n- `packages/components/nodes/tools/Arxiv/core.ts`\n\nThese files directly execute:\n\n```\nimportfetchfrom'node-fetch'\n```\n\nor invoke `axios` without passing through the centralized validation wrapper.\n\nBecause there is no global interceptor or enforcement mechanism, outbound requests in these components are executed without SSRF validation.\n\nThis renders the mitigation introduced in GHSA-2x8m-83vc-6wv4 incomplete.\n\n### Root Cause\n\nSecurity enforcement is not centralized.\n\nOutbound request validation depends on voluntary usage of a wrapper function rather than being structurally enforced.\n\nBecause direct imports of HTTP clients are allowed, the mitigation is easily bypassed.\n\nThis is an architectural enforcement failure rather than a single implementation bug.\n\n### PoC\nEven when an administrator configures:\n\n```\nHTTP_DENY_LIST=169.254.0.0/16,127.0.0.0/8\n```\n\nThe following attack succeeds if a vulnerable tool is enabled:\n\n**Chat Prompt:**\n\n```\nUse the Web Scraper tool to retrieve:\nhttp://169.254.169.254/latest/meta-data/iam/security-credentials/\n```\n\nExecution flow:\n\n1. The LLM triggers `WebScraperTool`.\n2. The tool calls raw `fetch()` directly.\n3. No `httpSecurity.ts` validation is applied.\n4. The request reaches the metadata endpoint.\n5. The response is returned to the chat context.\n\nThis demonstrates that SSRF protection is opt-in rather than enforced.\n### Impact\n\n**Severity:** Critical (CVSS v3.1: 9.1 – AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nThis issue:\n\n- Completely bypasses the centralized SSRF mitigation.\n- Allows access to internal network resources.\n- Enables the exploitation of cloud metadata and credential theft.\n- Invalidates the security assumptions of the recent patch.\n\nAny deployment enabling affected tools remains vulnerable.\n\n### Recommended Remediation\n\n1. Refactor all tools to use the centralized `secureFetch()` wrapper.\n2. Add ESLint `no-restricted-imports` rules to prohibit the direct usage of `node-fetch` or `axios` in tool components.\n3. Consider implementing a single internal HTTP client abstraction layer.\n4. Apply network-level egress filtering as defense-in-depth.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "flowise"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "3.1.0"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 3.0.13"
36+
}
37+
},
38+
{
39+
"package": {
40+
"ecosystem": "npm",
41+
"name": "flowise-components"
42+
},
43+
"ranges": [
44+
{
45+
"type": "ECOSYSTEM",
46+
"events": [
47+
{
48+
"introduced": "0"
49+
},
50+
{
51+
"fixed": "3.1.0"
52+
}
53+
]
54+
}
55+
],
56+
"database_specific": {
57+
"last_known_affected_version_range": "<= 3.0.13"
58+
}
59+
}
60+
],
61+
"references": [
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/FlowiseAI/Flowise"
69+
}
70+
],
71+
"database_specific": {
72+
"cwe_ids": [
73+
"CWE-918"
74+
],
75+
"severity": "MODERATE",
76+
"github_reviewed": true,
77+
"github_reviewed_at": "2026-04-16T21:23:03Z",
78+
"nvd_published_at": null
79+
}
80+
}

0 commit comments

Comments
 (0)