GHSA-8r8h-6vcc-xhrv: Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Summary

Flowise fetches a workspace's variables without enforcing the variables:view permission at the code-execution path in packages/components/src/utils.ts. Any user or API key that can call /api/v1/node-custom-function gets $vars pre-populated with every workspace variable, including runtime values read from process.env, so a caller denied variables:view can still read secrets such as database passwords, JWT secrets and cloud keys.

Mitigation

Enforce variables:view before injecting $vars, or inject only an explicit allowlist of the variables a function needs. In self-hosted deployments, consider disabling or heavily restricting type=runtime variables, or restrict which environment keys may be mapped.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12

Related items

• MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSimilar attack · BleepingComputer
• LowExtracting System Prompt of LLM Services in Complex (Agentic) Settings: Hierarchical Optimization and Reliable Evaluation MetricsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement StudySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumHow We Took Over ChatGPT AccountsSimilar attack · Simon Willison's Weblog
• Medium“Black October” for AI Developer PlatformsSimilar attack · Wiz Research Blog