CVE-2026-71962: flowise from 2.2.4 (inclusive), through 3.1.4 (inclusive); +1 more affected products

Affected technology

flowise · from 2.2.4 (inclusive), through 3.1.4 (inclusive)
flowiseai

Flowise · 2.2.4 through 3.1.4
FlowiseAI

Description’s affected range: versions 2.2.4 through 3.1.4

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Unauthenticated attackers can access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypasses all session and API key verification. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality impact as high; integrity and availability impact as none.