CVE-2026-30820: Flowise has Authorization Bypass via Spoofed x-request-from Header

March 6, 2026 (updated March 9, 2026)

Flowise trusts any HTTP client that sets the header x-request-from: internal, allowing an authenticated tenant session to bypass all /api/v1/** authorization checks. With only a browser cookie, a low-privilege tenant can invoke internal administration endpoints (API key management, credential stores, custom function execution, etc.), effectively escalating privileges.

References

github.com/FlowiseAI/Flowise
github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13
github.com/FlowiseAI/Flowise/security/advisories/GHSA-wvhq-wp8g-c7vq
github.com/advisories/GHSA-wvhq-wp8g-c7vq
nvd.nist.gov/vuln/detail/CVE-2026-30820

Code Behaviors & Features

Detect and mitigate CVE-2026-30820 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →