CVE-2026-41275 Flowise: Password Reset Link Sent Over Unsecured HTTP

High 7.5 Published 23 Apr 2026 Updated 25 Apr 2026

Attackers can intercept password reset links sent over HTTP to take over user accounts on Flowise cloud services.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-41275?

CVE-2026-41275 is a high-severity vulnerability in Flowiseai Flowise, published on 23 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password reset functionality on cloud.flowiseai.com sends a reset password link over the unsecured HTTP protocol instead of HTTPS. This behavior introduces the risk of a man-in-the-middle (MITM) attack, where an attacker on the same network as the user (e.g., public Wi-Fi) can intercept the reset link and gain unauthorized access to the victim’s account. This vulnerability is fixed in 3.1.0.

Weakness: CWE-319

Which versions are affected by CVE-2026-41275?

2 open source packages ship an affected version, including flowise. It affects 1 product.

Package	Affected	Fixed in
`flowise` npm	All versions	`3.1.0`
`flowise` npm	All versions	`3.1.0`

Products include Flowiseai Flowise.

How do I fix CVE-2026-41275?

Upgrade flowise to 3.1.0 or later.

Is CVE-2026-41275 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41275 exists.

All Flowiseai Flowise vulnerabilities

Sources

Also known as GHSA-x5w6-38gp-mrqh.