CVE-2026-30820: Flowise Authorization Bypass via Spoofed x-request-from Header

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-07 · updated 2026-06-17
Weakness: CWE-863

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowise trusts any HTTP client that sets the header x-request-from: internal, allowing an authenticated tenant session to bypass all /api/v1/** authorization checks. With only a browser cookie, a low-privilege tenant can invoke internal administration endpoints (API key management, credential stores, custom function execution, etc.), effectively escalating privilege. This issue has been patched in version 3.0.13.

Affected products

FlowiseAI Flowise: before 3.0.13 — fixed in 3.0.13

How to fix

Upgrade to a fixed version: FlowiseAI Flowise 3.0.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-30820 or the next vulnerability affects your stack