CVE-2026-56271 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-56271 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-56271 is a critical authentication bypass in Flowise before 3.1.0 (affected versions include 3.0.13 and earlier). If the JWT-related environment variables are not set, Flowise silently falls back to publicly known default values for token secrets, audience, and issuer. That makes it possible for an attacker to forge valid JWTs and impersonate any user, including administrators.

This is a CVSS 9.8 issue. Even though it is not known to be exploited in the wild and is not in CISA KEV right now, the impact is severe enough that solo developers and small teams should treat it as an emergency patch-and-verify item.

Immediate Action

  • Upgrade Flowise immediately to 3.1.0 or later. If you cannot patch within minutes, isolate the service from the internet and restrict access to trusted IPs/VPN only.
  • Set all JWT environment variables explicitly and confirm they are not using defaults: JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, and JWT_ISSUER.
  • Rotate any credentials or sessions that may have been issued while the vulnerable version was exposed, especially admin accounts and API tokens.
  • Review logs for suspicious logins, sudden privilege changes, or unusual token use. Assume any exposed instance may have been impersonated.
  • If you must roll back, do not roll back to another vulnerable build. Roll back only to a version with the fix or keep the service offline until patched.
  • Check vendor guidance and release notes here: vendor advisory / release notes.

Affected Versions

  • flowise@<=3.0.13 vulnerable; upgrade to 3.1.0+
  • flowise@3.0.13 vulnerable
  • flowise@3.1.0 and later: safe if the fix is present and JWT env vars are set correctly

Resolution Guide

JavaScript / Node.js

# npm
npm i flowise@^3.1.0

# yarn
yarn add flowise@^3.1.0

# pnpm
pnpm add flowise@^3.1.0

Python ecosystems are not directly affected by this specific product, but if you package or deploy Flowise alongside Python tooling, update the container or service image rather than trying to patch via pip/pipx.

Java ecosystems are not directly affected by this specific product, but if Flowise is embedded in a Java-based platform or delivered through a shared platform image, update the underlying application artifact or container.

Linux package managers are generally not the primary install path for Flowise, but if your deployment is wrapped in OS packages, update the package to the vendor-fixed build:

# apt
sudo apt update
sudo apt install --only-upgrade flowise

# yum/dnf
sudo yum update flowise
# or
sudo dnf update flowise

Docker

# Pull a fixed tag if available
docker pull flowiseai/flowise:3.1.0

# Example run with explicit secrets
docker run -d --name flowise \
  -e JWT_AUTH_TOKEN_SECRET='REPLACE_WITH_LONG_RANDOM_VALUE' \
  -e JWT_REFRESH_TOKEN_SECRET='REPLACE_WITH_LONG_RANDOM_VALUE' \
  -e JWT_AUDIENCE='your-app-audience' \
  -e JWT_ISSUER='your-app-issuer' \
  flowiseai/flowise:3.1.0

Config hardening

# .env example
JWT_AUTH_TOKEN_SECRET=use-a-strong-unique-secret
JWT_REFRESH_TOKEN_SECRET=use-a-different-strong-unique-secret
JWT_AUDIENCE=your-production-audience
JWT_ISSUER=your-production-issuer

If your deployment supports feature flags or module disabling, disable enterprise passport authentication middleware until you confirm the fix is deployed and the environment variables are set. If you cannot disable it cleanly, place the service behind a reverse proxy with strict access control.

Minimal code fix example — reject missing secrets instead of falling back to defaults:

const required = [
  process.env.JWT_AUTH_TOKEN_SECRET,
  process.env.JWT_REFRESH_TOKEN_SECRET,
  process.env.JWT_AUDIENCE,
  process.env.JWT_ISSUER,
];

if (required.some((v) => !v)) {
  throw new Error('Missing JWT configuration: set JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, and JWT_ISSUER');
}

Detection & Verification

Check the installed version:

npm ls flowise
# or
node -p "require('flowise/package.json').version"

Look for the vulnerable defaults in code or built artifacts:

grep -RIn "auth_token\|refresh_token\|AUDIENCE\|ISSUER" packages/server/src/enterprise/middleware/passport/index.ts

Check whether environment variables are actually set:

printenv | grep '^JWT_'

Dependency/audit checks:

npm audit
yarn audit
pnpm audit

Verify the fix by confirming the app fails closed when JWT variables are missing, and starts cleanly only when all four values are present. Also confirm that tokens signed with the old default values are rejected after the upgrade.

# Example sanity check: service should not start without JWT env vars
env -u JWT_AUTH_TOKEN_SECRET -u JWT_REFRESH_TOKEN_SECRET -u JWT_AUDIENCE -u JWT_ISSUER \
  node server.js

Risk and Impact

An attacker who can reach the service may forge JWTs and log in as any user, including an administrator. That can lead to full takeover of the Flowise instance, exposure of workflows, secrets, and connected data sources, and potential lateral movement into other internal systems.

For small teams, the blast radius is often larger than it looks: one exposed admin session can be enough to change integrations, leak credentials, or alter automation logic. Treat any internet-facing deployment as high risk until patched and verified.

Keep reading