CVE-2026-70473 is a high severity (CVSS 8.5) information disclosure in Flowise before 3.1.3. The GET /api/v1/upsert-history endpoint returns the whole server's upsert history, not just the caller's, including vector store settings. The fix is Flowise 3.1.3.
What's affected
Flowise (npm package flowise) versions up to and including 3.1.2, fixed in 3.1.3, per the GitHub advisory.
The weaknesses are CWE-200 (exposure of sensitive information), CWE-202 (exposure of sensitive information through data queries) and CWE-862 (missing authorization). The endpoint is not scoped to the requesting user, tenant or workspace. The advisory reports responses that can exceed 100 MB and that include integration settings such as a Qdrant server URL and collection name.
The vector has a changed scope, which is why the score is 8.5: the data belongs to other tenants and describes other systems, such as vector database hosts. Integrity impact is none and availability low, from the very large responses.
How to check if you're exposed
Check the installed version. For an npm install:
npm ls flowise
For Docker, read the image tag you run, and check the version shown in the Flowise interface. Anything before 3.1.3 is affected.
Then look at how you run it. The Flowise maintainers announced they are sunsetting the project, with the repository archived on 10 August 2026 and the npm packages and Docker images marked deprecated. The sunset page states that the code stays available under Apache 2.0 for forks. If you stay on Flowise, you own the patching, so plan who does it.
free in-browser dependency scan reads a package manifest in your browser and shows known vulnerabilities, including this one for the flowise npm package.
What to do now
- Check your Flowise version with npm ls flowise or the image tag.
- Upgrade to 3.1.3 or later, or to the build your fork maintains.
- Decide whether to stay on a project that is being wound down, or migrate.
- Review access logs for the affected routes for requests you do not recognize.
- Rotate any credentials stored in Flowise that other workspaces could have reached.
Why it matters
The data returned is configuration, not documents, and that is the subtle part. Hostnames, collection names and parameters of other tenants' systems are reconnaissance material. They do not give access alone, but they point an attacker at the next target.
The missing pagination matters too. An endpoint that returns everything without limits is both a leak and a cheap way to load a server. Scope every list endpoint by tenant and cap its size.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What kind of data leaks?
The advisory describes integration parameters and infrastructure details, such as vector store settings including a server URL and a collection name, for the whole server rather than one tenant.
Sources
Last reviewed: 18 October 2026.
