PT-2026-34739 · Flowise · Flowise

Published 2026-04-16 · Updated 2026-04-23 · CVE-2026-41275

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description The password reset functionality on the endpoint 'cloud.flowiseai.com' transmits the reset password link using the unsecured HTTP protocol rather than HTTPS. This allows an attacker on the same network to perform a man-in-the-middle (MITM) attack—a technique where a third party intercepts communication between two parties—to capture the reset link and gain unauthorized account access.

Recommendations Update to version 3.1.0.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2026-41275

GHSA-X5W6-38GP-MRQH

Affected Products

Flowise

References · 6

• 🔥 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x5w6-38gp-mrqh · Exploit
• 🔥 https://hackerone.com/reports/1888915 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41275 · Security Note
• https://osv.dev/vulnerability/GHSA-x5w6-38gp-mrqh · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://twitter.com/CVEnew/status/2047428072111321534 · Twitter Post