CVE-2026-70474: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

August 4, 2026

Three OAuth2 credential endpoints look up credentials by id alone with no workspaceId filter. Two of these endpoints (callback, refresh) are whitelisted from all authentication. This allows:

Cross-workspace credential access — Any authenticated user can initiate OAuth2 flows against credentials belonging to other workspaces.
Unauthenticated token injection — An unauthenticated attacker can forge OAuth2 callbacks to overwrite tokens in any credential.
Unauthenticated token refresh — An unauthenticated attacker can refresh tokens for any credential.

References

github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3
github.com/FlowiseAI/Flowise/security/advisories/GHSA-wch5-xp77-fxg4
github.com/advisories/GHSA-wch5-xp77-fxg4
nvd.nist.gov/vuln/detail/CVE-2026-70474

Code Behaviors & Features

Detect and mitigate CVE-2026-70474 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →