CVE-2026-41279
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint (POST /api/v1/text-to-speech/generate) is whitelisted (no auth) and accepts a credentialId directly in the request body. When called without a chatflowId, the endpoint uses the provided credentialId to decrypt the stored credential (e.g., OpenAI or ElevenLabs API key) and generate speech. This vulnerability is fixed in 3.1.0.
Ver en NVDAnálisis
Flowise versions prior to 3.1.0 contain a vulnerability where the text-to-speech generation endpoint is accessible without authentication. Attackers can provide a credential ID in the request to use your stored API keys, such as OpenAI or ElevenLabs, potentially exhausting your service quotas. Users self-hosting Flowise should update to version 3.1.0 immediately.
Severidad
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCWE-639EPSS
Afecta
flowiseai:flowiseDescripción técnica
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint (POST /api/v1/text-to-speech/generate) is whitelisted (no auth) and accepts a credentialId directly in the request body. When called without a chatflowId, the endpoint uses the provided credentialId to decrypt the stored credential (e.g., OpenAI or ElevenLabs API key) and generate speech. This vulnerability is fixed in 3.1.0.