p PatchFirst

PatchFirst · Latest vulnerabilities

flowise 3.0.10: known vulnerabilities · Page 5

Known vulnerabilities affecting flowise 3.0.10: 81. Compare the fixes below with your installed release.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 81

  1. CVE-2026-30820

    High · CVSS 8.7EPSS 0.5%Fix available

    Flowise Authorization Bypass via Spoofed x-request-from Header

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowise trusts any HTTP client that sets the header x-request-from: internal, allowing an authenticated tenant session to bypass all /api/v1/** authorization checks. With only a browser cookie, a low-privilege tenant can invoke internal administration endpoints (API key management, credential stores, custom function execution, etc.), effectively escalating privilege. This issue has been patched in version 3.0.13.

    flowiseNode.js
    • Update to 3.0.13
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →