CVE-2026-70478 is a critical (CVSS 10.0) information exposure in Flowise before 3.1.3. The OAuth2 credential refresh endpoint needs no login and returns a fresh access token to the caller. Upgrade to 3.1.3 and consider rotating the OAuth credentials stored in the instance.
What's affected
Flowise through version 3.1.2, fixed in 3.1.3, per the GitHub advisory for the flowise package.
The endpoint is POST /api/v1/oauth2-credential/refresh/ followed by a credential ID. It appears in the server's list of URLs that skip authentication. The advisory says an attacker needs a credential ID, which it describes as obtainable through other leaks or enumeration. It also notes the endpoint can be used to burn through refresh token quota.
How to check if you're exposed
Confirm the version.
npm ls flowise
Then see whether you store OAuth2 credentials in Flowise for services such as Google or Microsoft. If you do not, the practical impact is lower, though the version is still worth fixing.
In reverse proxy or application logs, look for calls to the oauth2-credential refresh path from addresses you do not recognize.
What to do now
- Upgrade to Flowise 3.1.3 or later.
- In the meantime, block the refresh path at your reverse proxy for anyone who is not signed in.
- Review the OAuth2 credentials stored in Flowise and rotate client secrets and refresh tokens for connected services.
- Check the connected accounts' own audit logs for unfamiliar token use.
- Keep credential IDs out of public chatflows and shared exports.
Why it matters
The record classes this as CWE-200, exposure of sensitive information to an unauthorized actor. The problem is a plain access control mistake: a route that does real work, decrypting stored secrets and talking to a third party, was added to the list of routes that skip login.
The server does the sensitive part on the attacker's behalf and hands back the result. The client secret never leaves the server, yet the token it produces does, and the token is what the attacker needs to reach the connected service. The advisory suggests removing the route from the public list and requiring authentication, which is the shape of the fix.
The KEV flag is false and the record does not describe exploitation.
Quick check
Do I need to rotate credentials after upgrading?
If the instance was reachable by untrusted users while on 3.1.2 or earlier and held OAuth2 credentials, rotating is a cheap precaution.
Sources
Last reviewed: 19 October 2026.
