CVE-2026-41275: Flowise: Password Reset Link Sent Over Unsecured HTTP
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password reset functionality on cloud.flowiseai.com sends a reset password link over the unsecured HTTP protocol instead of HTTPS. This behavior introduces the risk of a man-in-the-middle (MITM) attack, where an attacker on the same network as the user (e.g., public Wi-Fi) can intercept the reset link and gain unauthorized access to the victim’s account. This vulnerability is fixed in 3.1.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41275?
CVE-2026-41275 is considered a moderate severity vulnerability due to the risk of sensitive information being intercepted.
How do I fix CVE-2026-41275?
To fix CVE-2026-41275, upgrade Flowise to version 3.1.0 or later, which uses HTTPS for password reset links.
What are the risks associated with CVE-2026-41275?
The main risk of CVE-2026-41275 is potential exposure of users' sensitive data during the password reset process.
Which versions of Flowise are affected by CVE-2026-41275?
CVE-2026-41275 affects all versions of Flowise prior to version 3.1.0.
Where can I find more information about CVE-2026-41275?
Additional information about CVE-2026-41275 can typically be found in security advisories and vulnerability databases.