Description Summary:
Flowise is susceptible to a sandbox escape vulnerability via improper input validation in specific pandas methods, allowing authenticated attackers to execute arbitrary code.

Executive Summary:
An authenticated sandbox escape vulnerability in Flowise before version 3.1.3 poses a critical risk of arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-73484

Affected Software: FlowiseAI Flowise

Affected Versions: 0 up to (excluding) 3.1.3

Vulnerability: This vulnerability, identified as CWE-184, involves an incomplete list of disallowed inputs that allows a logged-in user to bypass sandbox restrictions when utilizing certain pandas methods. By providing malicious input, an authenticated attacker can achieve arbitrary code execution on the underlying host.

Business Impact

Successful exploitation of this vulnerability allows an attacker to break out of the application sandbox and execute commands with the privileges of the Flowise process. Given the CVSS score of 8.6, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, and potential lateral movement within the production environment.

Remediation Plan

Immediate Action: Upgrade all instances of Flowise to version 3.1.3 or later to apply the necessary input validation patches.

Proactive Monitoring: Inspect server logs for unusual pandas-related activity or unexpected system calls originating from the Flowise service account.

Compensating Controls: Restrict access to the Flowise interface to trusted users only and implement network segmentation to limit the impact of a potential container breakout.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the potential for escaping restricted execution environments.

Analyst Recommendation

The severity of this flaw necessitates immediate remediation. Administrators should prioritize upgrading to version 3.1.3 to close the sandbox escape vector, as the availability of proof-of-concept material increases the likelihood of opportunistic exploitation.

Description Summary:
Flowise is susceptible to a missing authorization vulnerability that allows unauthenticated attackers to perform unauthorized file downloads via the OpenAI Assistants integration.

Executive Summary:
An unauthenticated authorization bypass in Flowise allows remote attackers to access sensitive files, posing a high risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-71962

Affected Software: FlowiseAI Flowise

Affected Versions: 2.2.4 through 3.1.4

Vulnerability: This vulnerability, categorized as CWE-862 (Missing Authorization), occurs because the application fails to verify the user identity when accessing the OpenAI Assistants file download function. The attack vector is network-based and requires no authentication or user interaction to exploit.

Business Impact

The ability for an unauthenticated user to download files from the system could result in the exposure of proprietary data, sensitive API keys, or confidential documents managed within the platform. Given the CVSS score of 7.5, this high-severity flaw represents a significant risk to organizational data privacy and could lead to severe reputational damage if sensitive information is exfiltrated.

Remediation Plan

Immediate Action: Review the official FlowiseAI repository for security updates and apply the latest version to address this authorization gap. If a patch is not yet available, restrict network access to the Flowise instance to trusted IP addresses only.

Proactive Monitoring: Monitor server access logs for anomalous GET requests targeting file download endpoints or paths associated with OpenAI Assistants.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to identify and block unauthorized requests to file download directories.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its automatable nature and lack of required authentication.

Analyst Recommendation

This vulnerability presents a clear path for data exfiltration without requiring valid credentials. Administrators should prioritize identifying instances of Flowise within their environment and apply the necessary vendor updates as soon as they are published to prevent unauthorized access.

Description Summary:
Flowise contains an improper access control vulnerability, enabling unauthenticated attackers to bypass authorization checks via user-controlled keys.

Executive Summary:
A high-severity access control vulnerability in Flowise allows unauthenticated attackers to bypass authorization, potentially leading to unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-70476

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.2

Vulnerability: The application fails to properly enforce access controls (CWE-284) and is subject to authorization bypass through user-controlled keys (CWE-639). This vulnerability is accessible by unauthenticated attackers.

Business Impact

With a CVSS score of 8.3, this vulnerability presents a significant risk to the security of the Flowise environment. Unauthenticated access allows attackers to bypass security boundaries, potentially leading to unauthorized modification of LLM flows and system data, which could result in service disruption or loss of control over model outputs.

Remediation Plan

Immediate Action: Update Flowise to version 3.1.3 or later to ensure all access control and authorization bypass vulnerabilities are addressed.

Proactive Monitoring: Review application access logs for anomalous requests or unauthorized attempts to access protected endpoints.

Compensating Controls: Utilize a Web Application Firewall to block suspicious traffic patterns directed at the application API until the update is deployed.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is dangerous due to the lack of authentication required to trigger the access control failure.

Analyst Recommendation

The severity of this flaw, combined with the lack of required authentication, necessitates immediate action. Organizations must upgrade to Flowise version 3.1.3 or higher immediately to mitigate the risk of unauthorized access and data manipulation.

Description Summary:
Flowise contains a vulnerability involving missing authorization and improper information exposure, allowing authenticated users to access unauthorized sensitive data.

Executive Summary:
Flowise versions prior to 3.1.3 are vulnerable to an authorization bypass that exposes sensitive information to authenticated users, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-70473

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.3

Vulnerability: This vulnerability involves missing authorization controls and the exposure of sensitive information through data queries. It requires the attacker to have low-level authenticated access to the system to exploit the flaw.

Business Impact

The ability for an authenticated user to bypass authorization checks and access sensitive LLM flow data can lead to the compromise of proprietary workflows, API keys, or private configuration data. With a CVSS score of 8.3, this high-severity vulnerability represents a substantial risk to organizational data security, potentially leading to unauthorized data exfiltration and loss of integrity in customized AI deployments.

Remediation Plan

Immediate Action: Update Flowise to version 3.1.3 or later to apply the necessary authorization patches.

Proactive Monitoring: Review application access logs for unusual patterns of data retrieval or unexpected API requests originating from standard user accounts.

Compensating Controls: Implement strict network access controls and ensure that the Flowise instance is not exposed to the public internet without an identity-aware proxy or VPN.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 5, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is fundamentally an authorization failure, which is typically straightforward to weaponize once a target endpoint is identified.

Analyst Recommendation

The severity of this vulnerability, combined with the presence of proof-of-concept material, necessitates immediate action. Administrators must prioritize updating to version 3.1.3 to remediate the authorization bypass and prevent unauthorized access to sensitive LLM data.

Description Summary:
Flowise contains an incomplete list of disallowed inputs, which may allow an authenticated user to perform unauthorized actions within the Large Language Model flow interface.

Executive Summary:
A vulnerability in FlowiseAI Flowise allows authenticated users to bypass input validation filters, potentially leading to unauthorized data manipulation or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-69263

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.3

Vulnerability: The application is susceptible to an incomplete list of disallowed inputs (CWE-184), which occurs when input validation mechanisms fail to block malicious payloads. This vulnerability requires an attacker to have authenticated access (Low Privileges) to the Flowise user interface.

Business Impact

The exploitation of this vulnerability can result in the compromise of sensitive data or unauthorized flow execution within the LLM environment. With a CVSS score of 8.7, this issue is rated as high severity, reflecting the significant potential for impact on the integrity and availability of the customized LLM flows managed by the platform.

Remediation Plan

Immediate Action: Update Flowise to version 3.1.3 or later to apply the necessary input validation patches.

Proactive Monitoring: Review application access logs for unusual patterns involving API requests or unexpected input strings that deviate from standard flow configurations.

Compensating Controls: Implement strict network access controls to limit access to the Flowise interface only to trusted, authenticated users.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 5, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by authorized users who can craft specific inputs to bypass existing security filters.

Analyst Recommendation

Given the high CVSS rating and the availability of a proof-of-concept, administrators should prioritize updating to version 3.1.3 immediately. Failure to patch allows authenticated users to potentially manipulate LLM flows, which could lead to severe operational disruption or data leakage.

Description Summary:
Flowise is vulnerable to an authorization bypass and improper modification of object attributes, potentially allowing unauthenticated attackers to manipulate application behavior.

Executive Summary:
An authorization bypass vulnerability in Flowise allows unauthenticated attackers to potentially modify sensitive application attributes.

Vulnerability Details

CVE-ID: CVE-2026-69258

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.3

Vulnerability: This vulnerability involves an authorization bypass (CWE-639) and improper modification of dynamically determined object attributes (CWE-915). It allows an unauthenticated attacker to manipulate application logic.

Business Impact

Exploitation of this flaw can lead to unauthorized control over the large language model flows managed by the platform. With a CVSS score of 8.8, the lack of authentication requirements makes this a critical risk for any organization exposing the Flowise interface to the internet, as it could result in full application compromise.

Remediation Plan

Immediate Action: Upgrade Flowise to version 3.1.3 or higher to resolve the identified authorization bypass issues.

Proactive Monitoring: Monitor for unauthorized configuration changes or unexpected modifications to flow parameters within the application logs.

Compensating Controls: Ensure the Flowise dashboard is not exposed to the public internet and require VPN or mTLS authentication for all access.

Exploitation Status

Public Exploit Available: No (no confirmed public weaponized exploit exists in the provided data).

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to the lack of required authentication for exploitation.

Analyst Recommendation

Given that this vulnerability allows for unauthenticated access and modification, it should be treated as a top-priority patch. Organizations should ensure they are running the latest version and verify that their deployment is not publicly accessible.

Description Summary:
Flowise contains an authorization bypass vulnerability due to improper handling of user-controlled keys, allowing authenticated administrators to manipulate data.

Executive Summary:
A high-severity authorization bypass vulnerability in Flowise allows authenticated attackers with administrative privileges to potentially compromise data integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-69250

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.3

Vulnerability: The application is susceptible to an authorization bypass via user-controlled keys (CWE-639). This vulnerability requires the attacker to have administrative privileges to exploit the flaw successfully.

Business Impact

The ability for an authenticated administrator to bypass authorization checks poses a significant risk to the integrity and confidentiality of the large language model flows managed by the platform. With a CVSS score of 8.5, this high-severity flaw could lead to unauthorized data modification or access to sensitive model configurations, potentially impacting business operations and intellectual property.

Remediation Plan

Immediate Action: Update Flowise to version 3.1.3 or later to remediate this vulnerability.

Proactive Monitoring: Monitor administrative access logs for unusual patterns or attempts to access resources outside of assigned scopes.

Compensating Controls: Implement strict access control lists and review administrative user permissions to ensure the principle of least privilege is enforced until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any user possessing valid administrative credentials.

Analyst Recommendation

Given the high CVSS score and the existence of a proof-of-concept, organizations should treat this vulnerability with high priority. Administrators must verify their current version and apply the 3.1.3 update immediately to eliminate the authorization bypass risk.

Description Summary:
Flowise through 3.1.4 contains an insecure direct object reference vulnerability in its OpenAI Assistants integration that allows authenticated attackers to access data across different workspaces.

Executive Summary:
A critical authorization bypass vulnerability in Flowise allows authenticated attackers to access and manipulate data across restricted workspaces, posing a severe risk to data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-67622

Affected Software: FlowiseAI Flowise

Affected Versions: 0 through 3.1.4

Vulnerability: This vulnerability is an insecure direct object reference (CWE-639) occurring within the OpenAI Assistants integration. Authenticated attackers can bypass workspace ownership checks by supplying arbitrary credential UUIDs to endpoints, granting unauthorized access to cross-workspace metadata, file listings, and vector stores.

Business Impact

The ability for an authenticated user to access sensitive information across workspaces constitutes a major security failure. With a CVSS score of 9.9, this flaw enables lateral movement and data exfiltration, potentially exposing proprietary AI configurations, sensitive files, and vector data to unauthorized parties.

Remediation Plan

Immediate Action: Review vendor documentation for the availability of a security update and apply it immediately to all production instances.

Proactive Monitoring: Monitor server logs for suspicious API requests involving credential UUIDs that originate from unauthorized or unexpected user sessions.

Compensating Controls: Implement strict network-level access controls to restrict access to the Flowise management interface to only authorized personnel until a patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's high CVSS score is driven by the ease of exploitation and the significant potential for unauthorized data access.

Analyst Recommendation

Given the critical severity of this authorization bypass, administrators must prioritize identifying and patching affected Flowise deployments. Organizations should perform a thorough audit of their workspace data to determine if any unauthorized access has occurred while this vulnerability remained unpatched.

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in Flowise through 3.1.4 allows an authenticated attacker to perform unauthorized requests via the fetch links endpoint.

Executive Summary:
An SSRF vulnerability in Flowise allows authenticated attackers to abuse the fetch links endpoint to perform unauthorized outbound requests.

Vulnerability Details

CVE-ID: CVE-2026-67620

Affected Software: FlowiseAI Flowise

Affected Versions: 0 through 3.1.4

Vulnerability: This vulnerability is a Server-Side Request Forgery (CWE-918) caused by an incomplete deny-list in the fetch links endpoint. The attack requires low-level authentication to execute.

Business Impact

The CVSS score of 7.7 reflects the high potential for SSRF to be used to scan internal networks, access metadata services, or interact with internal APIs that are otherwise unreachable from the public internet. This can lead to significant data exposure and further escalation of privileges within the internal infrastructure.

Remediation Plan

Immediate Action: Review the Flowise vendor advisory for specific mitigation steps, as the product has reached a sunset phase.

Proactive Monitoring: Monitor outbound network traffic from the Flowise server for unusual connections to internal network segments or unauthorized external endpoints.

Compensating Controls: Implement strict egress filtering on the host machine to prevent the application from making unauthorized requests to internal resources or sensitive metadata services.

Exploitation Status

Public Exploit Available: Yes, a public Proof-of-Concept is available via GitHub.

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation in the wild. However, a public proof-of-concept exists on GitHub, which significantly lowers the barrier for potential attackers.

Analyst Recommendation

Given that Flowise has reached the end of its lifecycle, users should evaluate the necessity of the software and migrate to a supported alternative. If the software must remain in production, aggressive network-level egress filtering is required to mitigate the risk of SSRF exploitation.

Description Summary:
A vulnerability exists in the Flowise drag-and-drop user interface used for building Large Language Model (LLM) flows.

Executive Summary:
A high-severity vulnerability in the Flowise LLM workflow interface poses a significant risk to organizations utilizing this platform for AI automation.

Vulnerability Details

CVE-ID: CVE-2026-46480

Affected Software: FlowiseAI Flowise

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the Flowise interface, which is used for creating customized LLM flows. While specific technical details are limited, the severity score of 8.8 indicates a significant security deficiency potentially allowing for unauthorized access or code execution.

Business Impact

Compromise of the Flowise interface could allow attackers to manipulate LLM workflows, potentially leading to unauthorized data exfiltration, injection of malicious prompts, or disruption of AI-driven business processes. A CVSS score of 8.8 necessitates immediate attention to prevent the abuse of sensitive LLM integrations.

Remediation Plan

Immediate Action: Check the vendor's official documentation for the latest release and update the Flowise instance to the recommended secure version.

Proactive Monitoring: Review access logs for the Flowise dashboard and monitor for unusual workflow configurations or unauthorized project modifications.

Compensating Controls: Place the Flowise interface behind a reverse proxy or VPN with strict authentication requirements to minimize exposure to untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations integrating Flowise into their production pipelines should treat this vulnerability as urgent. Apply available patches immediately and audit existing LLM flows for any signs of tampering or unauthorized configuration changes.

Description Summary:
A security vulnerability exists within the Flowise drag-and-drop interface used for building customized large language model flows.

Executive Summary:
A high-severity vulnerability in the Flowise LLM workflow platform poses a significant risk to the integrity and confidentiality of integrated data environments.

Vulnerability Details

CVE-ID: CVE-2026-46479

Affected Software: Flowise Flowise

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Flowise interface. Users should assume that any flaw in this component requires prompt remediation to prevent unauthorized access or system-level exploitation.

Business Impact

A CVSS score of 8.8 warrants immediate remediation efforts to prevent potential compromise of the Flowise environment. Failure to address this could lead to unauthorized access to sensitive data processed by the LLM, resulting in severe operational or reputational damage.

Remediation Plan

Immediate Action: Ensure the installation is updated to the latest vendor-provided release.

Proactive Monitoring: Maintain detailed logs of all administrative actions within the Flowise interface to identify any unauthorized configuration changes.

Compensating Controls: Restrict access to the Flowise management interface to authorized personnel only via VPN or secure gateway solutions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity, it is imperative to maintain a proactive posture by applying updates as soon as they become available. Regularly auditing the security configuration of the Flowise environment is recommended to minimize the attack surface.

Description Summary:
A security vulnerability exists within the Flowise drag-and-drop interface used for building customized large language model flows.

Executive Summary:
A high-severity vulnerability in the Flowise LLM workflow platform poses a significant risk to the integrity and confidentiality of integrated data environments.

Vulnerability Details

CVE-ID: CVE-2026-46478

Affected Software: Flowise Flowise

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an issue within the Flowise workflow interface. As with related entries, the flaw requires immediate attention to prevent unauthorized interaction with LLM orchestration components.

Business Impact

With a CVSS score of 8.8, this vulnerability indicates a high potential for impact, potentially allowing attackers to compromise LLM flow integrity. This could lead to unauthorized data processing or the injection of malicious instructions into the language model pipelines.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor immediately upon release to address the underlying vulnerability.

Proactive Monitoring: Monitor application logs for anomalous activity, particularly actions related to workflow creation or modification by non-authorized users.

Compensating Controls: Utilize Web Application Firewalls (WAF) to monitor and block potentially malicious payload structures targeting the Flowise interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this vulnerability with high urgency. Ensure that the Flowise instance is not exposed to untrusted networks and apply all vendor-supplied patches promptly to secure the LLM infrastructure.

Description Summary:
A security vulnerability exists within the Flowise drag-and-drop interface used for building customized large language model flows.

Executive Summary:
A high-severity vulnerability in the Flowise LLM workflow platform poses a significant risk to the integrity and confidentiality of integrated data environments.

Vulnerability Details

CVE-ID: CVE-2026-46477

Affected Software: Flowise Flowise

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an issue within the Flowise workflow interface. While specific authentication requirements are currently pending further disclosure, similar flaws in low-code platforms often permit unauthorized execution or data access.

Business Impact

Successful exploitation of this flaw could result in unauthorized access to sensitive LLM data pipelines or the manipulation of workflow logic. Given the CVSS score of 8.8, this vulnerability represents a high risk that could lead to significant data exfiltration or service disruption if attackers gain control over LLM orchestration.

Remediation Plan

Immediate Action: Update the Flowise deployment to the latest version provided by the vendor as soon as an official security patch is released.

Proactive Monitoring: Review system and application access logs for unusual traffic patterns or unauthorized API requests directed at the Flowise interface.

Compensating Controls: Implement strict network access controls and utilize a Web Application Firewall (WAF) to filter suspicious requests targeting the workflow builder.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Flowise must prioritize the monitoring of vendor security channels for patch availability. Due to the high CVSS score, it is recommended to isolate the service from public-facing networks until a verified update is applied to mitigate the risk of unauthorized workflow manipulation.

Description Summary:
A mass assignment vulnerability in Flowise allows an authenticated user to take over custom templates belonging to other workspaces.

Executive Summary:
A high-severity mass assignment vulnerability in Flowise allows authenticated users to hijack other users' custom templates, potentially compromising proprietary LLM workflows.

Vulnerability Details

CVE-ID: CVE-2026-46476

Affected Software: Flowise

Affected Versions: Prior to 3.1.2

Vulnerability: This is a mass assignment flaw where any authenticated user with edit permissions can reassign a custom template to any workspace by guessing or enumerating the workspace UUID. This allows for unauthorized modification or theft of custom LLM flow configurations.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant risk to the integrity of AI-driven business processes. Unauthorized access to custom LLM templates can lead to the exposure of sensitive logic, intellectual property theft, or the injection of malicious prompts into corporate workflows.

Remediation Plan

Immediate Action: Upgrade Flowise to version 3.1.2 or later to address the mass assignment vulnerability.

Proactive Monitoring: Review access logs for unusual workspace modification requests or unauthorized enumeration of UUIDs.

Compensating Controls: Implement strict access control policies and ensure that workspace identifiers are not exposed in client-side responses or predictable formats.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 16, 2026, a public exploit is available. The relative ease of enumerating UUIDs makes this a high-priority risk for all Flowise deployments.

Analyst Recommendation

The combination of a mass assignment flaw and a public exploit makes this a critical security concern. Organizations should update their Flowise installations immediately and audit existing workspace configurations to ensure no templates have been subject to unauthorized reassignment.

Description Summary:
A mass-assignment vulnerability in Flowise allows authenticated users to move assistants between workspaces, resulting in cross-workspace takeover.

Executive Summary:
A mass-assignment flaw in the Flowise platform allows authenticated users to hijack assistants from other workspaces, leading to unauthorized data access and flow manipulation.

Vulnerability Details

CVE-ID: CVE-2026-46475

Affected Software: Flowise

Affected Versions: Prior to version 3.1.2

Vulnerability: This is a mass-assignment vulnerability occurring during the creation or update of assistants. By manipulating the workspaceId in a PUT request, an authenticated user can reassign an assistant to a workspace they control.

Business Impact

With a CVSS score of 8.8, this vulnerability allows for significant unauthorized access within multi-tenant or collaborative environments. The potential for cross-workspace takeover could result in the compromise of sensitive LLM flows and proprietary data, severely impacting organizational security posture.

Remediation Plan

Immediate Action: Update the Flowise platform to version 3.1.2 or later to correct the mass-assignment vulnerability.

Proactive Monitoring: Review access and API logs for unusual PUT requests or unauthorized attempts to modify workspace associations.

Compensating Controls: Implement strict role-based access control (RBAC) and validate that users only have permissions within their intended workspace to limit the impact of such flaws.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to manipulate workspace associations represents a critical authorization bypass. Administrators must update to the latest version immediately to ensure that workspace isolation is properly enforced and to prevent unauthorized access to sensitive LLM flows.

Description Summary:
Flowise versions prior to 3.1.2 lack authentication middleware on CRUD endpoints for OpenAI Assistants Vector Store, enabling unauthorized data modification.

Executive Summary:
A high-severity authentication bypass vulnerability in Flowise allows unauthenticated attackers to modify or delete sensitive data within OpenAI Assistants Vector Stores.

Vulnerability Details

CVE-ID: CVE-2026-46444

Affected Software: Flowise

Affected Versions: Prior to 3.1.2

Vulnerability: All CRUD endpoints related to the OpenAI Assistants Vector Store lack necessary authentication middleware. This allows an unauthenticated remote attacker to perform unauthorized operations, including the modification or deletion of data managed within the Flowise interface.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to the integrity and availability of AI-driven workflows. An attacker could destroy valuable training data or inject malicious information into vector stores, leading to corrupted model behavior and potential loss of intellectual property.

Remediation Plan

Immediate Action: Upgrade Flowise to version 3.1.2 or later to implement the required authentication middleware.

Proactive Monitoring: Review access logs for the Flowise administrative interface and monitor for unauthorized API requests targeting the Vector Store endpoints.

Compensating Controls: Implement network-level access controls to restrict access to the Flowise management interface to authorized internal IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The absence of authentication on critical API endpoints makes this an urgent security priority. All users of Flowise must upgrade to version 3.1.2 immediately to secure the platform against unauthorized data manipulation. Restricting network access to the application is a recommended secondary measure until the update is fully deployed.

Description Summary:
An authorization bypass in the Flowise text-to-speech endpoint allows unauthenticated attackers to decrypt and potentially expose stored API credentials via a crafted request.

Executive Summary:
Flowise versions prior to 3.1.0 are vulnerable to an authorization bypass that permits unauthenticated access to sensitive API credentials.

Vulnerability Details

CVE-ID: CVE-2026-41279

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.0

Vulnerability: The vulnerability exists in the text-to-speech generation endpoint (POST /api/v1/text-to-speech/generate), which fails to perform proper authorization checks. An unauthenticated attacker can supply a credentialId in the request body to decrypt and access sensitive stored credentials, such as OpenAI or ElevenLabs API keys.

Business Impact

The exposure of API keys poses a significant risk to organizational security, as these credentials can be used to incur unauthorized costs or access private LLM infrastructure. With a CVSS score of 7.5, this high-severity flaw could lead to data exfiltration or service disruption. Unauthorized access to these keys compromises the integrity of the integrated LLM workflows and the associated cloud accounts.

Remediation Plan

Immediate Action: Update Flowise to version 3.1.0 or later immediately to apply the necessary authorization checks for the text-to-speech endpoint.

Proactive Monitoring: Review API access logs for unusual POST requests to the /api/v1/text-to-speech/generate endpoint, specifically looking for requests that lack associated chatflow identifiers.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to the /api/v1/text-to-speech/generate endpoint, limiting traffic to trusted internal IP addresses until the patch can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of authentication on a sensitive administrative function.

Analyst Recommendation

Given the ease of exploitation, which requires no authentication, organizations should prioritize upgrading their Flowise instances to version 3.1.0 as soon as possible. Failure to patch may result in the compromise of sensitive third-party API credentials, leading to financial loss or further unauthorized access. Ensure all development and production environments are covered by this update.

Description Summary:
Flowise versions prior to 3.1.0 expose sensitive credentials, including plaintext API keys and password fields, via unauthenticated public API endpoints due to a lack of data sanitization.

Executive Summary:
A critical information disclosure vulnerability in Flowise allows unauthenticated attackers to retrieve plaintext API keys and sensitive configuration data.

Vulnerability Details

CVE-ID: CVE-2026-41278

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.0

Vulnerability: This vulnerability involves the improper exposure of sensitive information (CWE-200) through the GET /api/v1/public-chatflows/:id and public-chatbotConfig endpoints. The application fails to sanitize flow data, allowing unauthenticated actors to access credential IDs and plaintext secrets intended for internal use.

Business Impact

The exposure of API keys and password fields presents a severe risk to the confidentiality and integrity of connected services. An attacker gaining these credentials could pivot into integrated cloud platforms or LLM providers, leading to unauthorized data access, financial loss through service abuse, or complete compromise of downstream infrastructure. Given the CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized access to sensitive environment configurations.

Remediation Plan

Immediate Action: Update Flowise to version 3.1.0 or later immediately to apply the necessary sanitization logic to public endpoints.

Proactive Monitoring: Review API access logs for suspicious requests to the public-chatflows and public-chatbotConfig endpoints, particularly from unknown or unauthorized IP addresses.

Compensating Controls: Implement strict network access controls or a Web Application Firewall (WAF) to restrict access to the /api/v1/public-chatflows/ endpoint to trusted network segments until patching is complete.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its status as an unauthenticated, automatable information disclosure.

Analyst Recommendation

This vulnerability represents a significant security oversight that exposes highly sensitive configuration data to the public internet. Organizations utilizing Flowise should prioritize upgrading to version 3.1.0 without delay to ensure that sensitive credentials are no longer returned by the public API. Failure to remediate this issue leaves the environment susceptible to credential theft and subsequent unauthorized lateral movement across integrated services.

Description Summary:
A mass assignment vulnerability in the Flowise DocumentStore creation endpoint allows authenticated users to perform unauthorized object modifications or cross-workspace takeovers.

Executive Summary:
Flowise versions prior to 3.1.0 are vulnerable to an access control flaw that permits authenticated users to overwrite and hijack DocumentStore objects across workspaces.

Vulnerability Details

CVE-ID: CVE-2026-41277

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.0

Vulnerability: This is a mass assignment vulnerability (CWE-915) combined with improper access control (CWE-284). By controlling the primary key during the creation of a DocumentStore entity, an authenticated user can trigger an implicit update operation that modifies or overwrites existing objects belonging to other workspaces or tenants.

Business Impact

The ability to perform cross-workspace object modification poses a significant risk to data integrity and confidentiality in multi-tenant environments. An attacker could potentially gain unauthorized access to proprietary large language model flows or disrupt service availability for other users. With a CVSS score of 8.8, this high-severity vulnerability necessitates immediate attention to prevent unauthorized data manipulation.

Remediation Plan

Immediate Action: Update Flowise to version 3.1.0 or later to include the required security patches for the DocumentStore endpoint.

Proactive Monitoring: Review audit logs for unusual POST requests to the DocumentStore creation endpoint, specifically looking for unexpected primary key (id) assignments or high volumes of object creation activity.

Compensating Controls: Implement strict object-level authorization checks at the application layer or utilize a Web Application Firewall (WAF) to filter requests that attempt to modify sensitive internal state fields.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 25, 2026, there is no public information indicating active exploitation in the wild. However, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it leverages existing repository functions to facilitate unauthorized data access.

Analyst Recommendation

Given the potential for cross-tenant data compromise, administrators should prioritize upgrading to version 3.1.0 immediately. Organizations operating multi-tenant Flowise instances are at the highest risk and should verify that all workspace isolation controls are functioning as expected following the update.

Description Summary:
Flowise versions prior to 3.1.0 transmit password reset links over unsecured HTTP, exposing users to man-in-the-middle attacks that could result in account takeover.

Executive Summary:
Flowise contains a critical vulnerability involving cleartext transmission of sensitive reset tokens, which permits unauthorized account access via man-in-the-middle attacks.

Vulnerability Details

CVE-ID: CVE-2026-41275

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.0

Vulnerability: This vulnerability is classified as CWE-319, involving the transmission of sensitive password reset links over unencrypted HTTP. An attacker on the same network as the victim can intercept these links to compromise user accounts without requiring prior authentication.

Business Impact

Successful exploitation allows an attacker to intercept password reset links, leading to complete account takeover. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to data confidentiality and integrity, potentially allowing unauthorized access to customized large language model flows and associated proprietary data.

Remediation Plan

Immediate Action: Update the Flowise software to version 3.1.0 or later to ensure all sensitive communications are forced over HTTPS.

Proactive Monitoring: Review access logs for suspicious patterns originating from local network segments or unusual IP ranges, especially during password reset activities.

Compensating Controls: Enforce strict network security policies, such as the use of VPNs or encrypted tunnels, for all users accessing the Flowise interface until the update is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown).

Analyst Notes: As of April 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw relies on the attacker being in a position to intercept network traffic, such as on public or shared Wi-Fi networks.

Analyst Recommendation

The risk of account takeover via unencrypted credential recovery is significant for all deployments of Flowise. Administrators must prioritize updating to version 3.1.0 immediately to remediate this cleartext transmission flaw and protect user accounts from interception attacks.

Description Summary:
Flowise contains an authentication bypass vulnerability allowing unauthenticated attackers to retrieve OAuth 2.0 access tokens and internal workflow data via public chatflow configuration endpoints.

Executive Summary:
A critical authentication bypass in Flowise versions prior to 3.1.0 allows unauthenticated attackers to exfiltrate sensitive OAuth credentials and internal workflow configurations.

Vulnerability Details

CVE-ID: CVE-2026-41273

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.0

Vulnerability: This vulnerability is a missing authentication for critical function (CWE-306) flaw, which permits an unauthenticated attacker to interact with public chatflow configuration endpoints to extract OAuth 2.0 access tokens.

Business Impact

The exploitation of this vulnerability leads to unauthorized access to sensitive credential data, potentially allowing attackers to compromise connected services that rely on these OAuth tokens. With a CVSS score of 8.2, this flaw poses a High risk to organizational security, as it facilitates the exfiltration of internal workflow data and enables further lateral movement or service impersonation.

Remediation Plan

Immediate Action: Update Flowise to version 3.1.0 or later immediately to incorporate the required authentication checks.

Proactive Monitoring: Review access logs for anomalous requests directed at chatflow configuration endpoints and monitor for unexpected OAuth token refresh activity.

Compensating Controls: If immediate patching is not feasible, restrict network access to the Flowise administrative and configuration interfaces to trusted IP ranges using a firewall or reverse proxy.

Exploitation Status

Public Exploit Available: No (There is no confirmed public exploit in the available data).

Analyst Notes: As of April 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no interaction from a privileged user to disclose sensitive configuration data.

Analyst Recommendation

Given the ease of exploitability and the potential for unauthorized access to sensitive authentication tokens, organizations should prioritize the update to Flowise 3.1.0. Failure to patch leaves the underlying large language model workflows and associated third-party service integrations exposed to credential theft.

Description Summary:
Flowise core security wrappers contain logic flaws allowing Server-Side Request Forgery (SSRF) via DNS rebinding or insufficient allow list enforcement.

Executive Summary:
Flowise versions prior to 3.1.0 are susceptible to Server-Side Request Forgery, which may allow authenticated attackers to bypass security controls and interact with internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-41272

Affected Software: FlowiseAI Flowise

Affected Versions: Flowise < 3.1.0, flowise-components < 3.1.0

Vulnerability: The application fails to properly validate requests within its core security wrappers (secureAxiosRequest and secureFetch), enabling SSRF attacks. An authenticated attacker can exploit these logic flaws to bypass intended allow or deny lists, potentially accessing sensitive internal services.

Business Impact

Successful exploitation of this SSRF vulnerability allows an attacker to interact with internal systems that are not exposed to the public internet. This can lead to the unauthorized disclosure of internal data, interaction with internal APIs, or the circumvention of network segmentation. Given the CVSS score of 7.1, this represents a high-risk security flaw that could facilitate deeper lateral movement within the network infrastructure.

Remediation Plan

Immediate Action: Update both the Flowise and flowise-components packages to version 3.1.0 or later to implement the corrected request filtering logic.

Proactive Monitoring: Review application logs for suspicious outbound requests originating from the Flowise service, particularly those targeting internal IP addresses or local loopback interfaces.

Compensating Controls: Implement strict egress filtering on the host machine running Flowise to prevent the application from initiating unauthorized network connections to internal infrastructure.

Exploitation Status

Public Exploit Available: No confirmed public exploit (weaponized or otherwise) is currently available in the provided data.

Analyst Notes: As of April 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability relies on logic errors in request handling, making it a viable target for attackers attempting to map or compromise internal network segments.

Analyst Recommendation

Organizations utilizing Flowise must prioritize the update to version 3.1.0 to resolve the identified logic flaws in the security wrappers. Because this vulnerability facilitates SSRF, failing to patch may expose internal services to unauthorized access. Apply the update immediately to ensure the integrity of your internal network environment.

Description Summary:
A Server-Side Request Forgery vulnerability in FlowiseAI Flowise allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems.

Executive Summary:
A Server-Side Request Forgery vulnerability in FlowiseAI Flowise versions prior to 3.1.0 poses a significant risk of data exfiltration and internal network reconnaissance.

Vulnerability Details

CVE-ID: CVE-2026-41271

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.0

Vulnerability: This vulnerability is a Server-Side Request Forgery (CWE-918) flaw located in the POST/GET API Chain components, which can be triggered by unauthenticated attackers to conduct unauthorized requests against internal and external infrastructure.

Business Impact

The ability to perform Server-Side Request Forgery allows an attacker to interact with internal services that are typically shielded from the public internet. This can lead to the exposure of sensitive internal data, unauthorized access to private APIs, or the mapping of internal network architecture, resulting in severe reputational and operational damage. Given the CVSS score of 8.3, this vulnerability is classified as High severity and requires immediate attention to prevent exploitation.

Remediation Plan

Immediate Action: Upgrade both the flowise and flowise-components packages to version 3.1.0 or later to apply the necessary security patch.

Proactive Monitoring: Review web server and API access logs for anomalous outbound traffic patterns or requests directed toward internal IP ranges.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block suspicious API requests and restrict outbound traffic from the application server to prevent unauthorized internal network access.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available; the available data does not indicate a weaponized exploit or public proof-of-concept.

Analyst Notes: As of April 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows an attacker to use the server as a proxy to bypass network security controls.

Analyst Recommendation

The presence of a proof-of-concept and the high CVSS score necessitate immediate remediation. Security teams should prioritize updating their Flowise deployments to version 3.1.0 to close the SSRF vector, as this flaw provides a direct path for attackers to compromise internal resources that would otherwise be inaccessible.

Description Summary:
A Server-Side Request Forgery protection bypass exists in the Flowise Custom Function feature, allowing authenticated users to access internal network resources via the NodeVM sandbox.

Executive Summary:
A Server-Side Request Forgery vulnerability in Flowise allows authenticated users to bypass security controls and access sensitive internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-41270

Affected Software: FlowiseAI Flowise and flowise-components

Affected Versions: FlowiseAI Flowise: < 3.1.0; FlowiseAI flowise-components: < 3.1.0

Vulnerability: This flaw involves an improper access control issue where the NodeVM sandbox permits the use of Node.js modules like http, https, and net, which bypass established SSRF protections. The vulnerability is exploitable by any authenticated user with access to the Custom Function feature.

Business Impact

The ability for an attacker to perform SSRF requests poses a significant risk to internal infrastructure. By reaching internal-only services, such as cloud provider metadata endpoints or internal APIs, an attacker could potentially exfiltrate sensitive configuration data, credentials, or internal network topology information. Given the CVSS score of 7.1, this is classified as a High severity issue that requires immediate attention to prevent lateral movement within the network.

Remediation Plan

Immediate Action: Update both Flowise and flowise-components to version 3.1.0 or later to apply the necessary sandbox restrictions.

Proactive Monitoring: Review application and server logs for unusual outbound network requests originating from the Flowise instance, particularly those targeting internal IP addresses or cloud metadata services.

Compensating Controls: If immediate patching is not feasible, restrict network access for the Flowise server to only essential external services, effectively isolating it from sensitive internal segments.

Exploitation Status

Public Exploit Available: No confirmed public exploit (weaponized or published PoC) exists in the provided data.

Analyst Notes: As of April 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it leverages the underlying flexibility of the NodeVM sandbox to circumvent intended security boundaries.

Analyst Recommendation

This vulnerability represents a high-risk security gap that can be leveraged to compromise internal systems through the Flowise interface. Organizations should prioritize upgrading to version 3.1.0 immediately to eliminate the bypass mechanism. Failure to remediate this issue leaves the environment vulnerable to unauthorized internal network reconnaissance and potential data exfiltration.

Description Summary:
Flowise versions prior to 3.1.0 allow authenticated users to upload malicious JavaScript files, potentially leading to remote code execution on the server.

Executive Summary:
A critical vulnerability in Flowise allows authenticated attackers to achieve remote code execution through the upload of malicious JavaScript files.

Vulnerability Details

CVE-ID: CVE-2026-41269

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.0

Vulnerability: The application fails to properly restrict file upload types within the Chatflow configuration, allowing an authenticated attacker to bypass frontend restrictions and upload arbitrary JavaScript files. This flaw enables the persistent storage of malicious Node.js web shells on the host server.

Business Impact

The ability to execute arbitrary code on the host server poses a severe threat to the confidentiality, integrity, and availability of the entire environment. An attacker could gain full control over the Flowise instance, potentially leading to data exfiltration, lateral movement within the network, or the compromise of sensitive credentials associated with the LLM workflows. With a CVSS score of 7.1, this high severity vulnerability necessitates immediate attention to prevent system takeover.

Remediation Plan

Immediate Action: Update Flowise to version 3.1.0 or later to apply the necessary file type validation and security patches.

Proactive Monitoring: Review web server logs for suspicious POST requests to configuration endpoints and monitor for the creation of unexpected JavaScript files within the application directory.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing suspicious MIME types or unauthorized file extensions until the patch can be applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows direct execution of server-side code.

Analyst Recommendation

The risk of remote code execution via arbitrary file upload is significant and requires urgent remediation. Administrators must prioritize updating to version 3.1.0 to close the attack vector. If an immediate update is not feasible, restrict access to the Chatflow configuration interface to trusted users only and employ strict egress filtering to prevent potential web shells from communicating with external command and control servers.

Description Summary:
Flowise versions prior to 3.1.0 are vulnerable to unauthenticated remote command execution via parameter injection, allowing attackers to execute arbitrary system commands with root privileges.

Executive Summary:
Flowise versions prior to 3.1.0 contain a critical unauthenticated remote command execution vulnerability that allows attackers to gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-41268

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.0

Vulnerability: This vulnerability is an improper input validation flaw (CWE-20) that allows an unauthenticated attacker to inject arbitrary commands through a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODE_OPTIONS environment variable injection.

Business Impact

The ability for an unauthenticated attacker to achieve remote command execution with root privileges poses a catastrophic risk to the integrity, confidentiality, and availability of the host system. Given the CVSS score of 7.7, this flaw represents a high-severity threat that could lead to full system compromise, data exfiltration, or the deployment of persistent malware within the containerized environment.

Remediation Plan

Immediate Action: Update Flowise and Flowise-components to version 3.1.0 or later immediately to apply the necessary input validation patches.

Proactive Monitoring: Review web access logs for suspicious HTTP requests containing the string "FILE-STORAGE::" or references to "NODE_OPTIONS" and monitor container environments for unauthorized child processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block incoming requests containing unexpected parameter overrides or suspicious environment variable injection patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous due to its potential for unauthenticated root access within a containerized environment.

Analyst Recommendation

The severity of this vulnerability, combined with the ease of exploitation, necessitates an immediate update to version 3.1.0 across all instances. Organizations should prioritize patching this software above lower-risk updates to prevent potential full-system compromise by unauthenticated actors.

Description Summary:
An improper mass assignment vulnerability in the Flowise account registration endpoint allows unauthenticated attackers to modify sensitive object attributes and bypass authorization controls.

Executive Summary:
An unauthenticated mass assignment vulnerability in Flowise versions prior to 3.1.0 allows attackers to manipulate account metadata and escalate privileges, posing a critical risk to multi-tenant environments.

Vulnerability Details

CVE-ID: CVE-2026-41267

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.0

Vulnerability: This vulnerability involves improper mass assignment and authorization bypass via the account registration endpoint. An unauthenticated attacker can inject server-managed fields and nested objects, allowing them to manipulate ownership, organization associations, and role mappings.

Business Impact

The ability for an unauthenticated attacker to manipulate account metadata and roles creates a significant risk of unauthorized access to sensitive large language model flows and data. In a multi-tenant environment, this flaw allows for cross-tenant data access and administrative takeovers. With a CVSS score of 8.1, this high-severity vulnerability could lead to total compromise of an organization's Flowise deployment and the underlying data processed by the models.

Remediation Plan

Immediate Action: Update Flowise to version 3.1.0 or later immediately to resolve the mass assignment flaw.

Proactive Monitoring: Review account registration logs and user metadata for any accounts created with unexpected roles, administrative permissions, or incorrect organization associations.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect incoming registration traffic for unexpected JSON fields or nested objects that deviate from the expected schema.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown).

Analyst Notes: As of April 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it targets the trust boundary of the registration process, allowing an attacker to manipulate server-side state without authentication.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, organizations utilizing Flowise must prioritize the upgrade to version 3.1.0. This update is essential to prevent unauthorized modification of system objects and to restore the integrity of the multi-tenant authorization model. Failure to patch may result in unauthorized access to proprietary AI workflows and sensitive user data.

Description Summary:
Flowise versions prior to 3.1.0 contain an unauthenticated information disclosure vulnerability in the chatbot configuration API, exposing sensitive credentials and internal configuration data.

Executive Summary:
Flowise versions prior to 3.1.0 are vulnerable to unauthenticated credential theft, posing a significant risk of unauthorized access to downstream systems and services.

Vulnerability Details

CVE-ID: CVE-2026-41266

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.0

Vulnerability: This vulnerability occurs because the /api/v1/public-chatbotConfig/:id endpoint lacks proper authentication checks, allowing unauthenticated attackers to retrieve sensitive API keys and authorization headers by providing a valid chatflow UUID.

Business Impact

The exposure of API keys and HTTP headers can lead to full compromise of the services integrated with Flowise, potentially resulting in unauthorized data access, lateral movement within the network, or financial loss. With a CVSS score of 7.5, this high severity flaw represents a critical failure in access control, as it allows external actors to bypass security measures without requiring any user credentials.

Remediation Plan

Immediate Action: Upgrade to Flowise version 3.1.0 or later immediately to apply the necessary authentication requirements to the chatbot configuration API.

Proactive Monitoring: Review access logs for the /api/v1/public-chatbotConfig/ endpoint to identify unauthorized requests or anomalous patterns of chatflow UUID enumeration.

Compensating Controls: Implement strict network-level access controls or a Web Application Firewall (WAF) to block unauthorized access to the Flowise API endpoints until the update can be deployed.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly automatable due to the nature of the endpoint, making proactive patching essential.

Analyst Recommendation

Given the high impact of exposed credentials and the simplicity of the attack vector, organizations using Flowise must prioritize upgrading to version 3.1.0. Failure to patch allows attackers to gain persistent access to integrated services, which may be difficult to remediate after a breach has occurred.

Description Summary:
Flowise contains a code injection vulnerability in AirtableAgent.ts due to improper input sanitization, which allows authenticated attackers to achieve remote code execution.

Executive Summary:
Flowise versions prior to 3.1.0 are vulnerable to remote code execution, posing a critical risk to systems utilizing the AirtableAgent component.

Vulnerability Details

CVE-ID: CVE-2026-41138

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.0

Vulnerability: The vulnerability is a code injection flaw (CWE-94) within the AirtableAgent.ts file, where user-supplied input is passed directly into Python code without sanitization. An authenticated user can leverage this lack of input verification to execute arbitrary code on the underlying system.

Business Impact

The ability to execute arbitrary code allows an attacker to gain complete control over the affected server, potentially leading to unauthorized data access, system compromise, or lateral movement within the network. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that could lead to significant operational disruption and data loss.

Remediation Plan

Immediate Action: Update Flowise and flowise-components to version 3.1.0 or later immediately to resolve the vulnerable code path in AirtableAgent.ts.

Proactive Monitoring: Review application access logs for unusual queries or characters within prompt template parameters that might indicate an attempt to inject malicious code.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict input validation rules to block malicious payloads targeting the affected agent interface until the update can be deployed.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly exploitable due to the direct reflection of unsanitized user input into the Python execution environment.

Analyst Recommendation

Given the potential for remote code execution and the existence of a proof-of-concept, this vulnerability must be addressed with high priority. Organizations using Flowise should verify their current version and apply the 3.1.0 update across all environments to eliminate the injection vector. Continued monitoring of administrative and agent-related traffic is recommended to ensure no unauthorized activity has occurred.

Description Summary:
Flowise versions prior to 3.1.0 contain a code injection vulnerability in the CSVAgent, allowing authenticated attackers to execute arbitrary commands on the server via unsanitized CSV read code.

Executive Summary:
An authenticated code injection vulnerability in Flowise allows attackers to achieve full system compromise, necessitating an immediate update to version 3.1.0.

Vulnerability Details

CVE-ID: CVE-2026-41137

Affected Software: FlowiseAI Flowise and flowise-components

Affected Versions: Flowise < 3.1.0; flowise-components < 3.1.0

Vulnerability: The vulnerability is a code injection flaw (CWE-94) within the CSVAgent component. It allows an authenticated user to supply malicious input for Pandas CSV read operations, resulting in unauthorized command execution on the host server.

Business Impact

Successful exploitation of this flaw allows an attacker to execute arbitrary code with the privileges of the application process. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full system takeover, unauthorized access to sensitive large language model data, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update both Flowise and flowise-components to version 3.1.0 or later immediately to incorporate the necessary sanitization logic.

Proactive Monitoring: Monitor server logs for suspicious process execution patterns or unusual file system activity originating from the Flowise service account.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious payloads typically associated with command or code injection attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the direct nature of the command injection vector.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity and availability of the Flowise environment. Administrators must prioritize updating to version 3.1.0 to eliminate the injection vector. Failure to patch may expose the underlying host infrastructure to complete unauthorized control by authenticated users.

Description Summary:
Flowise prior to 3.1.0 is vulnerable to OS command injection due to unsafe serialization of stdio commands in the MCP adapter, allowing authenticated attackers to execute arbitrary commands.

Executive Summary:
An authenticated command injection vulnerability in Flowise allows attackers to execute arbitrary code on the underlying host OS.

Vulnerability Details

CVE-ID: CVE-2026-40933

Affected Software: Flowise

Affected Versions: Prior to 3.1.0

Vulnerability: The vulnerability exists in the "Custom MCP" configuration interface, where insufficient input sanitization allows an authenticated attacker to inject malicious arguments into stdio commands, bypassing existing validation checks.

Business Impact

Successful exploitation grants an attacker full control over the underlying server, enabling data exfiltration, ransomware deployment, or complete system takeover. With a CVSS score of 9.9, this vulnerability represents a critical threat to the confidentiality, integrity, and availability of the host environment.

Remediation Plan

Immediate Action: Upgrade Flowise to version 3.1.0 or later immediately to address the command injection flaw.

Proactive Monitoring: Audit logs for suspicious process creation or unusual command executions originating from the Flowise service account.

Compensating Controls: Implement strict network segmentation and ensure the application runs with the least-privilege principle to contain potential breaches.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of command injection, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a severe risk to infrastructure integrity. Administrators should apply the 3.1.0 update immediately and conduct a thorough review of the application's configuration to ensure no malicious MCP servers were added prior to the patch.

Description Summary:
A high-severity vulnerability in the Flowise LLM flow builder could allow attackers to compromise customized large language model flows.

Executive Summary:
Flowise contains a high-severity security vulnerability that could lead to the unauthorized manipulation or compromise of LLM-based application workflows.

Vulnerability Details

CVE-ID: CVE-2026-30823

Affected Software: Flowise

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability affects the Flowise drag-and-drop interface used for building LLM flows. Based on the CVSS score of 8.8, the flaw likely permits an attacker to intercept or modify the logic of AI applications.

Business Impact

Successful exploitation could lead to "prompt injection" at scale, data exfiltration from connected vector databases, or the hijacking of AI-driven business processes. The CVSS score of 8.8 highlights the significant risk to the integrity of AI infrastructure.

Remediation Plan

Immediate Action: Update Flowise to the latest version immediately to resolve the identified security flaw.

Proactive Monitoring: Audit LLM flow configurations for unauthorized changes and monitor API logs for unusual request patterns.

Compensating Controls: Ensure that Flowise is deployed within a secure network perimeter and that all users are authenticated via a centralized identity provider.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 8, 2026, no active exploitation has been reported. As LLM frameworks become more prevalent, they are increasingly targeted by researchers and threat actors alike.

Analyst Recommendation

Apply the vendor's security updates without delay. AI orchestration tools often have broad access to internal data sources, making their security paramount to the overall safety of the organization's data.

Description Summary:
Flowise versions prior to 3.0.13 allow unauthenticated users to inject arbitrary values into internal database fields when creating leads through the application interface.

Executive Summary:
A critical vulnerability in Flowise allows unauthenticated attackers to perform unauthorized database modifications, risking the integrity of user-defined LLM workflows.

Vulnerability Details

CVE-ID: CVE-2026-30822

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.0.13

Vulnerability: This vulnerability is caused by improper control over dynamically determined object attributes (CWE-915). It allows an unauthenticated attacker to manipulate internal database fields during the lead creation process.

Business Impact

The ability for an unauthenticated user to inject arbitrary data into the application database poses a significant risk to data integrity and system security. With a CVSS score of 7.7, this high-severity flaw could lead to unauthorized system configuration changes or the corruption of sensitive LLM flow logic, potentially resulting in downstream operational impact or unauthorized access to backend processes.

Remediation Plan

Immediate Action: Update Flowise to version 3.0.13 or later immediately to incorporate the provided security fix.

Proactive Monitoring: Review application access logs for suspicious lead submission patterns or unexpected database write activity originating from unauthenticated sessions.

Compensating Controls: Implement strict network access controls to limit exposure of the Flowise interface and utilize a Web Application Firewall (WAF) to filter malicious input payloads targeting the lead creation endpoint.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of this flaw makes it a prime target for automated scanning and mass exploitation attempts against exposed instances.

Analyst Recommendation

Given the high CVSS severity and the existence of a proof-of-concept, organizations must prioritize patching this vulnerability. Failure to update to version 3.0.13 leaves the application exposed to unauthorized database manipulation by any network-adjacent attacker. Immediate deployment of the vendor patch is the only reliable method to mitigate this risk.

Description Summary:
Flowise versions prior to 3.0.8 contain a path traversal vulnerability in WriteFileTool and ReadFileTool, allowing authenticated attackers to read or write arbitrary files on the system.

Executive Summary:
An authenticated path traversal vulnerability in Flowise allows remote attackers to read or write arbitrary files, potentially leading to full remote code execution on the host system.

Vulnerability Details

CVE-ID: CVE-2025-61913

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.0.8

Vulnerability: The vulnerability exists due to improper input validation in the WriteFileTool and ReadFileTool functions, which fail to restrict file path access, permitting authenticated users to perform unauthorized file system operations.

Business Impact

The ability to read and write arbitrary files on the underlying server presents an extreme risk to data confidentiality, integrity, and availability. Given the CVSS score of 9.9, this vulnerability is critical, as it allows an attacker to manipulate system configurations or inject malicious payloads to achieve remote command execution, effectively compromising the entire application environment.

Remediation Plan

Immediate Action: Update Flowise to version 3.0.8 or later immediately to apply the necessary path validation fixes.

Proactive Monitoring: Review application and system logs for unauthorized file access attempts or suspicious activity originating from authenticated user sessions.

Compensating Controls: Implement strict network segmentation and ensure the application runs with the least privilege necessary to limit the potential blast radius of a successful exploit.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Oct 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the combination of file system access and the potential for remote code execution.

Analyst Recommendation

Given the critical CVSS severity and the documented potential for remote code execution, this vulnerability poses a severe threat to organizational infrastructure. Administrators must prioritize upgrading Flowise to version 3.0.8 to eliminate the path traversal vector, as any delay in remediation leaves the system exposed to full administrative compromise by authenticated actors.

Description Summary:
Flowise version 3.0.7 contains an unrestricted file upload vulnerability that allows authenticated users to upload malicious Node.js scripts, potentially leading to Remote Code Execution.

Executive Summary:
A high-severity file upload vulnerability in Flowise version 3.0.7 allows authenticated users to achieve Remote Code Execution through the storage of malicious Node.js web shells.

Vulnerability Details

CVE-ID: CVE-2025-61687

Affected Software: FlowiseAI Flowise

Affected Versions: 3.0.7

Vulnerability: This is an unrestricted file upload vulnerability (CWE-434) residing in the attachment handling logic. Authenticated users can bypass validation mechanisms to store arbitrary files, including Node.js web shells, on the server.

Business Impact

The ability to upload arbitrary files poses a critical risk to system integrity and confidentiality. By storing and subsequently executing malicious scripts, an attacker can gain full control over the application server, leading to unauthorized data access and complete service compromise. The CVSS score of 8.3 reflects the high potential for impact on system integrity and availability.

Remediation Plan

Immediate Action: Upgrade Flowise to version 3.0.8 or later to resolve the underlying file validation flaw.

Proactive Monitoring: Review application access logs for unusual file upload activity, specifically looking for attempts to upload non-standard file types or requests to suspicious endpoints.

Compensating Controls: Implement strict file upload policies at the Web Application Firewall level to block executable file extensions and ensure that the storage directory for attachments is configured to prevent script execution.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of October 7, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows for persistent storage of malicious payloads that can be triggered at a later time.

Analyst Recommendation

Given the potential for Remote Code Execution and the availability of proof-of-concept information, organizations should prioritize upgrading their Flowise instances to version 3.0.8. If an immediate update is not feasible, restrict access to the file upload functionality to trusted users only and apply rigorous input validation at the network perimeter to mitigate the risk of malicious file injection.

Description Summary:
Flowise version 3.0.5 is vulnerable to unauthenticated remote code execution via the CustomMCP node, which improperly validates user input before passing it to the JavaScript Function constructor.

Executive Summary:
Flowise version 3.0.5 contains a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript with full system privileges.

Vulnerability Details

CVE-ID: CVE-2025-59528

Affected Software: FlowiseAI Flowise

Affected Versions: 3.0.5

Vulnerability: The vulnerability exists within the CustomMCP node, where the mcpServerConfig string is processed by the convertToValidJSONString function. This function insecurely passes user input directly into a JavaScript Function constructor, resulting in arbitrary code execution with the full privileges of the Node.js runtime.

Business Impact

This vulnerability carries a CVSS score of 10.0, representing the highest level of severity. An unauthenticated attacker can achieve complete system compromise, leading to unauthorized data exfiltration, the installation of persistent backdoors, or the total destruction of the host environment. Given the nature of Flowise as a tool for managing large language model flows, successful exploitation could also result in the compromise of sensitive model data and integrated API credentials.

Remediation Plan

Immediate Action: Update Flowise to version 3.0.6 or later immediately to apply the necessary input validation fixes.

Proactive Monitoring: Review system and application logs for unexpected process execution, particularly those involving child processes or unauthorized access to the filesystem.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious JavaScript payloads in HTTP requests, though this should be considered a temporary measure pending a full update.

Exploitation Status

Public Exploit Available: Yes, a public exploit is available via a Metasploit module and an ExploitDB entry.

Analyst Notes: As of Sep 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication and the direct execution of malicious input via the Node.js runtime.

Analyst Recommendation

Due to the critical nature of this vulnerability and the availability of weaponized exploit code, organizations must prioritize patching Flowise to version 3.0.6. Failure to update immediately exposes the underlying infrastructure to complete takeover. If immediate patching is not feasible, the application should be isolated from public network access until the remediation is successfully deployed and verified.

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in Flowise version 3.0.5 allows unauthenticated attackers to leverage the server as a proxy to access internal network resources.

Executive Summary:
Flowise version 3.0.5 contains a critical Server-Side Request Forgery vulnerability that enables unauthenticated attackers to probe internal network services.

Vulnerability Details

CVE-ID: CVE-2025-59527

Affected Software: Flowise Flowise

Affected Versions: 3.0.5

Vulnerability: The application is susceptible to a Server-Side Request Forgery (SSRF) via the /api/v1/fetch-links endpoint. This allows an unauthenticated attacker to force the server to initiate requests to arbitrary internal network locations.

Business Impact

Successful exploitation allows an adversary to bypass network perimeters and interact with internal services that are not exposed to the public internet. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk of internal reconnaissance, potentially exposing sensitive data or providing an entry point for further lateral movement within the corporate network.

Remediation Plan

Immediate Action: Upgrade the Flowise application to version 3.0.6 or later to incorporate the vendor-supplied security patch.

Proactive Monitoring: Review web access logs for unusual requests directed at the /api/v1/fetch-links endpoint, particularly those containing internal IP addresses or non-standard port numbers.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to the /api/v1/fetch-links endpoint and implement egress filtering on the server to prevent unauthorized outbound connections to internal network segments.

Exploitation Status

Public Exploit Available: No (the available data does not confirm a public exploit).

Analyst Notes: As of September 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to execute, allowing any network-adjacent attacker to reach sensitive internal infrastructure.

Analyst Recommendation

The presence of a proof-of-concept and the unauthenticated nature of this SSRF flaw necessitate an immediate update to version 3.0.6. Organizations should prioritize patching this vulnerability to prevent potential internal reconnaissance and unauthorized access to sensitive backend services.

Description Summary:
A cross-tenant data exposure vulnerability in Flowise Cloud allows authenticated users to access sensitive environment variables and secrets from other tenants via the Custom JavaScript Function node.

Executive Summary:
An authenticated vulnerability in Flowise Cloud allows unauthorized access to sensitive tenant secrets, posing a critical risk of cross-tenant data exposure.

Vulnerability Details

CVE-ID: CVE-2025-59434

Affected Software: FlowiseAI Flowise Cloud

Affected Versions: Cloud-hosted versions prior to August 2025

Vulnerability: This flaw involves improper access control (CWE-284) and exposure of sensitive information (CWE-200), where any authenticated user on the free tier can leverage the Custom JavaScript Function node to extract secrets from other tenants.

Business Impact

The exploitation of this vulnerability leads to a total compromise of sensitive environment variables, including OpenAI API keys, AWS credentials, Supabase tokens, and Google Cloud secrets. With a CVSS score of 9.6, this represents a critical risk of unauthorized access to backend infrastructure and third-party services, potentially resulting in significant financial and data security breaches across the entire organization.

Remediation Plan

Immediate Action: Ensure that all Flowise Cloud instances are updated to the August 2025 version or later, as the vendor has implemented a fix for this cross-tenant isolation issue.

Proactive Monitoring: Review access logs for any suspicious or unauthorized usage of the Custom JavaScript Function node by standard users.

Compensating Controls: Restrict the use of the Custom JavaScript Function node to trusted administrative accounts until the environment is fully verified as patched.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the direct access it grants to high-privilege cloud secrets across tenant boundaries.

Analyst Recommendation

Given the critical CVSS severity score of 9.6 and the potential for total credential theft, organizations using the Flowise Cloud platform must prioritize this update immediately. Failure to remediate allows any authenticated user the potential to pivot into broader cloud infrastructure, making rapid deployment of the August 2025 patch the only effective path to securing your environment.

Description Summary:
The forgot-password endpoint in Flowise versions 3.0.5 and earlier exposes sensitive information, allowing unauthenticated attackers to gain unauthorized access.

Executive Summary:
A critical information disclosure vulnerability in Flowise 3.0.5 and earlier allows unauthenticated attackers to extract sensitive data via the forgot-password endpoint.

Vulnerability Details

CVE-ID: CVE-2025-58434

Affected Software: FlowiseAI Flowise

Affected Versions: <= 3.0.5

Vulnerability: This is a missing authentication vulnerability (CWE-306) affecting the forgot-password endpoint. The service fails to properly secure this critical function, allowing an unauthenticated attacker to retrieve sensitive information.

Business Impact

The CVSS score of 9.8 indicates a maximum severity, reflecting that the vulnerability is easily exploitable over the network without user interaction. Exposure of sensitive data through this endpoint could lead to full system compromise, loss of intellectual property contained within LLM flows, and complete unauthorized administrative access.

Remediation Plan

Immediate Action: Update Flowise to version 3.0.6 or later immediately to resolve the authentication bypass.

Proactive Monitoring: Monitor logs for high volumes of requests to the forgot-password endpoint, which may indicate automated scanning or exploitation attempts.

Compensating Controls: If an immediate update is not possible, restrict access to the Flowise management interface to trusted IP addresses using a WAF or VPN.

Exploitation Status

Public Exploit Available: Yes — a public exploit is available via ExploitDB and detection templates exist in Nuclei.

Analyst Notes: As of Sep 12, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Multiple public PoCs are available on GitHub, increasing the likelihood of opportunistic attacks.

Analyst Recommendation

Due to the availability of public exploits and the critical nature of the vulnerability, immediate patching is required. Organizations running Flowise must upgrade to version 3.0.6 to prevent unauthorized system access and data breach.

Description Summary:
Flowise versions prior to 3.0.5 are susceptible to a Cross-site Scripting vulnerability that allows malicious code execution via an IFRAME element within the administrative chat log view.

Executive Summary:
A Cross-site Scripting vulnerability in Flowise allows unauthenticated attackers to execute malicious scripts in the context of an administrator session, posing a significant risk to platform integrity.

Vulnerability Details

CVE-ID: CVE-2025-50538

Affected Software: FlowiseAI Flowise

Affected Versions: 0 up to (excluding) 3.0.5

Vulnerability: This vulnerability is a Cross-site Scripting (CWE-79) flaw that allows an attacker to inject malicious IFRAME elements into the chat log. When an administrator views these logs, the injected script executes within their authenticated browser session.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to administrative sessions, potential data theft, and the compromise of sensitive credentials or platform configurations. With a CVSS score of 8.2, this issue is classified as High severity, reflecting the significant risk of session hijacking and unauthorized administrative actions within the application.

Remediation Plan

Immediate Action: Update the Flowise installation to version 3.0.8 or later to resolve the underlying vulnerability.

Proactive Monitoring: Monitor administrative access logs for unusual IFRAME activity or unexpected redirects when accessing the chat history interface.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the loading of unauthorized IFRAME sources and utilize a Web Application Firewall (WAF) to filter suspicious script injection patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of October 7, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it relies on the application failing to sanitize user-supplied input before rendering it in the administrative console.

Analyst Recommendation

Given the High severity rating and the identified proof-of-concept risk, organizations running Flowise should prioritize applying the provided security update immediately. Administrators must ensure that their instances are patched to version 3.0.8 to prevent potential session compromise and ensure the security of the administrative environment.

Description Summary:
Flowise versions prior to 3.0.5 are vulnerable to Cross-site Scripting (XSS) via FORM and INPUT elements when an administrator views chat logs.

Executive Summary:
A stored Cross-site Scripting vulnerability in Flowise allows unauthenticated attackers to execute malicious scripts in an administrator's browser session, potentially leading to unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2025-29192

Affected Software: FlowiseAI Flowise

Affected Versions: 0 up to 3.0.5

Vulnerability: The application fails to properly neutralize user-supplied input within FORM and INPUT elements, allowing an attacker to inject malicious scripts that execute when an administrator views the chat logs. This flaw is classified as CWE-79 and requires no authentication to trigger the initial injection.

Business Impact

The successful exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the Flowise administrative interface. By compromising an administrator session, an attacker could potentially gain unauthorized access to sensitive data, modify system configurations, or perform actions on behalf of the administrator. With a CVSS score of 8.2, this vulnerability is categorized as High severity due to the potential for administrative account takeover.

Remediation Plan

Immediate Action: Update the Flowise installation to version 3.0.5 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Review administrative access logs and monitor for unusual activity, particularly within the chat log management modules, to identify potential exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common XSS payloads, particularly those targeting FORM and INPUT parameters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of October 7, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it targets the administrative interface, which is a high value target for attackers seeking to escalate privileges within the application environment.

Analyst Recommendation

Given the High severity of this vulnerability and the existence of a proof-of-concept, organizations using Flowise should prioritize the update to version 3.0.5 immediately. Failure to patch allows for a clear path to session hijacking and administrative compromise. Please ensure all instances are verified against the fixed version to eliminate this risk.