What is CVE-2026-70471?
CVE-2026-70471 is a critical vulnerability in Flowise's code execution sandbox where $vars injection bypasses the permission-protected Variables API, allowing unauthorized access to workspace variables without requiring 'variables:view' permission. This affects Flowise versions prior to 3.1.3, and users should immediately upgrade to version 3.1.3 or later to mitigate the issue.
Azərbaycanca: CVE-2026-70471, Flowise LLM alətində $vars injecti ilə sandbox mühitindən çıxışa imkan verən kritik boşluqdur. Bu, icazə ilə qorunan Variables API-sini keçərək kod icrasına yol açır, 'variables:view' icazəsi olmadan istənilən workspace dəyişənləri ifşa oluna bilər. İstifadəçilər dərhal 3.1.3 və ya daha yuxarı versiyaya yeniləməlidir.
FAQ2
What does the CVE-2026-70471 vulnerability cause in Flowise?
CVE-2026-70471 causes a sandbox escape in Flowise's code execution environment via $vars injection, bypassing the permission-protected Variables API and exposing any workspace variables without requiring the 'variables:view' permission.
Which version should I upgrade to in order to mitigate CVE-2026-70471?
To mitigate this vulnerability, you should immediately upgrade Flowise to version 3.1.3 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.