CVE-2026-41276 is a critical authentication bypass (CVSS 9.8) in Flowise. Before 3.1.0, someone who knows a user's email address can reset that user's password by sending an empty or null reset token. The fix is Flowise 3.1.0. After upgrading, review accounts for unexpected password changes.
What's affected
The GitHub advisory lists the npm package flowise at 3.0.13 and earlier, with 3.1.0 as the patched version. The advisory reproduces a Zero Day Initiative report (ZDI-CAN-28762), which scores the issue at 8.1, while the NVD record shows 9.8.
How to check if you're exposed
npm ls flowise
For containers, read the image tag. If your instance has user accounts and is reachable from outside your network, it is exposed on any version up to 3.0.13. Instances with no accounts, or no network exposure, carry less risk.
To look for abuse, check your logs for calls to the account reset password endpoint, and compare them with real reset requests that users made.
What to do now
- Upgrade Flowise to 3.1.0 or later.
- Force a password reset for administrator and other high privilege accounts on instances that were exposed.
- Review audit logs and recent logins for sessions that users do not recognise.
- Rotate API keys and credentials that those accounts could reach.
- Put the instance behind a VPN or access proxy where public access is not needed.
Why it matters
The record lists CWE-287, improper authentication. The advisory explains the cause: the reset method never checks that a reset token was actually issued for the account. By default the stored token value is null, or an empty string after a prior reset, so a request with a matching empty value succeeds.
It is a small logic slip with a full account takeover as the result. A secure reset flow requires a non-empty, unexpired, single use token that the server created, and it compares in constant time. The record does not flag this CVE as known exploited.
Quick check
Why do two different scores appear for this bug?
The ZDI text in the advisory rates it 8.1 because it counts attack complexity as high. NVD lists 9.8. Either way, no login is needed.
Sources
Last reviewed: 19 October 2026.
