CVE-2025-59434

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59434", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-15T19:13:16.906Z", "datePublished": "2025-09-22T19:39:03.774Z", "dateUpdated": "2025-09-22T19:47:56.540Z"}, "containers": {"cna": {"title": "Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22"}], "affected": [{"vendor": "FlowiseAI", "product": "Flowise", "versions": [{"version": "< cloud-hosted (as of Aug 2025)", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-22T19:39:03.774Z"}, "descriptions": [{"lang": "en", "value": "Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from other tenants via the Custom JavaScript Function node. This includes secrets such as OpenAI API keys, AWS credentials, Supabase tokens, and Google Cloud secrets \u2014 resulting in a full cross-tenant data exposure. This issue has been patched in the August 2025 Cloud-Hosted Flowise."}], "source": {"advisory": "GHSA-435c-mg9p-fv22", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-22T19:47:22.934320Z", "id": "CVE-2025-59434", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-22T19:47:56.540Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59434", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-22T19:47:22.934320Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-22T19:47:30.339Z"}}], "cna": {"title": "Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function", "source": {"advisory": "GHSA-435c-mg9p-fv22", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "FlowiseAI", "product": "Flowise", "versions": [{"status": "affected", "version": "< cloud-hosted (as of Aug 2025)"}]}], "references": [{"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22", "name": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from other tenants via the Custom JavaScript Function node. This includes secrets such as OpenAI API keys, AWS credentials, Supabase tokens, and Google Cloud secrets \u2014 resulting in a full cross-tenant data exposure. This issue has been patched in the August 2025 Cloud-Hosted Flowise."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-22T19:39:03.774Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59434", "state": "PUBLISHED", "dateUpdated": "2025-09-22T19:47:56.540Z", "dateReserved": "2025-09-15T19:13:16.906Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-22T19:39:03.774Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Flowise", "vendor": "FlowiseAI", "versions": [{"status": "affected", "version": "< cloud-hosted (as of Aug 2025)"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from other tenants via the Custom JavaScript Function node. This includes secrets such as OpenAI API keys, AWS credentials, Supabase tokens, and Google Cloud secrets \u2014 resulting in a full cross-tenant data exposure. This issue has been patched in the August 2025 Cloud-Hosted Flowise."}, {"lang": "es", "value": "Flowise es una interfaz de usuario de arrastrar y soltar para construir un flujo de modelo de lenguaje grande personalizado. Antes de Flowise Alojado en la Nube de agosto de 2025, una vulnerabilidad autenticada en Flowise Cloud permite a cualquier usuario del nivel gratuito acceder a variables de entorno sensibles de otros inquilinos a trav\u00e9s del nodo de Funci\u00f3n JavaScript Personalizada. Esto incluye secretos como claves API de OpenAI, credenciales de AWS, tokens de Supabase y secretos de Google Cloud - lo que resulta en una exposici\u00f3n completa de datos entre inquilinos. Este problema ha sido parcheado en Flowise Alojado en la Nube de agosto de 2025."}], "id": "CVE-2025-59434", "lastModified": "2026-10-11T20:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59434", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-22T19:47:22.934320Z", "version": "2.0.3"}}]}, "published": "2025-09-22T20:15:39.017", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Flowise: Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function", "id": "2397489", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397489"}, "csaw": false, "cwe": "(CWE-200|CWE-284)", "details": ["No description is available for this CVE."], "name": "CVE-2025-59434", "public_date": "2025-09-22T19:39:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-59434\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59434\nhttps://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22"], "threat_severity": "Critical"}

{"created": "2025-09-23T16:03:35.188722+00:00", "updated": "2025-09-23T16:03:35.188795+00:00", "vendors": ["flowiseai", "flowiseai$PRODUCT$flowise"]}