CVE-2026-70471

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description Flowise injects $vars into the code execution sandbox without requiring the variables:view permission, which bypasses the permission-protected Variables API. An unauthorized user or API key denied variables:view can call the /api/v1/node-custom-function endpoint and receive $vars pre-populated with all workspace variables. This includes static variables (mapped from Variable.name to Variable.value) and runtime variables (mapped from Variable.name to process.env[Variable.name]). This flaw can expose sensitive secrets, including database passwords, JWT secrets, SMTP passwords, and cloud keys, depending on the workspace configuration.

Recommendations Update to version 3.1.3. Restrict the use of type=runtime variables in self-hosted environments or limit which environment keys can be mapped.