THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-70478 (CRITICAL 10.0) — Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the stored credential, se

[NVD] CVE-2026-70478 (CRITICAL 10.0) — Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the stored credential, se

lownvdPublished 2026-08-04

CVE-2026-70478 CVSS: 10.0 CRITICAL Published: 2026-08-04T20:16:54.610

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh request to the configured OAuth pro

Indicators of compromise

CVE-2026-70478cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-70478