PT-2026-35296

Summary /api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration without any authentication. An attacker with knowledge just of a chatflow UUID can retrieve credentials stored in password type fields and HTTP headers,...

PT-2026-35305

Summary Flowise is vulnerable to a critical unauthenticated remote command execution RCE vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODE OPTIONS environment variable injection. This allows for the execution of arbitrary syst...

PT-2026-34733

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0 Description Flowise is a drag and drop user interface for building customized large language model flows. An unauthenticated remote command execution issue exists where a parameter override bypass can be achieve...

PT-2026-35308

ZDI-CAN-28762: Flowise AccountService resetPassword Authentication Bypass Vulnerability -- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise - Flowise -- VULNERABILITY DETAILS...

PT-2026-35298

Summary Flowise contains an authentication bypass vulnerability that allows an unauthenticated attacker to obtain OAuth 2.0 access tokens associated with a public chatflow. By accessing a public chatflow configuration endpoint, an attacker can retrieve internal workflow data, including OAuth...

PT-2026-51775

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0 Description A missing authentication issue exists in the '/api/v1/loginmethod' endpoint. Unauthenticated users can retrieve an organization's complete Single Sign-On SSO configuration, including OAuth client...

CVE-2026-43995

creationtimestamp| type| source ---|---|--- 2026-04-15 14:11:30+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c...

Exploit for Code Injection in Flowiseai Flowise

CVE-2025-59528 — Flowise AI Authenticated Remote Code Executio...

Exploit for Missing Authentication for Critical Function in Flowiseai Flowise

Flowise-CVE-2025-58434-PasswordReset Unauthenticated...

Exploit for Code Injection in Flowiseai Flowise

CVE-2025-59528-PoC A simple python script to exploit CVE-2025-...

Exploit for Code Injection in Flowiseai Flowise

CVE-2025-59528 – Flowise CustomMCP Node RCE PoC !Visitors...

Exploit for Missing Authentication for Critical Function in Flowiseai Flowise

Flowise Dual CVE PoC — CVE-2025-58434 + CVE-2025-59528 !CVE-...

Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed

Threat actors are exploiting a maximum-severity security flaw in Flowise , an open-source artificial intelligence AI platform, according to new findings from VulnCheck. The vulnerability in question is CVE-2025-59528 CVSS score: 10.0, a code injection vulnerability that could result in remote cod...

The vulnerability of the v1/fetch-links interface of the software platform for creating user interfaces based on Language Models (LLMs) like Flowise allows a attacker to perform an SSRF attack.

The vulnerability of the v1/fetch-links interface of the software platform for creating user interfaces based on Language Models LLMs from Flowise is related to insufficient validation of requests at the server-side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF...

The vulnerability of Flowise Cloud, a software platform for creating user interfaces based on Language Models (LLMs), allows a hacker to gain access to confidential information.

The vulnerability of Flowise Cloud, a software platform for creating user interfaces based on Language Models LLMs, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to confidential information...

The vulnerability of Flowise’s software platform for creating user interfaces based on language models (LLMs) lies in the lack of authentication for a critical function, allowing attackers to execute arbitrary commands.

The vulnerability of the software platform for creating user interfaces based on language models LLM in Flowise is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the `convertToValidJSONString` function in the software platform for creating user interfaces based on language models (LLM) called Flowise allows a perpetrator to execute arbitrary code.

The vulnerability of the convertToValidJSONString function in the software platform for creating user interfaces based on language models LLM called Flowise is related to improper code generation management. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Server-side Request Forgery (SSRF)

Overview flowise-ui is a Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the HTTP Node as it is used in AgentFlow and Chatflow. An attacker can access internal network resources, retrieve sensitive information, or modify and delete data by supplying crafte...

EUVD-2026-10931

Flowise affected by Server-Side Request Forgery SSRF in HTTP Node Leading to Internal Network Access...

Server-side Request Forgery (SSRF)

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the HTTP Node as it is used in AgentFlow and Chatflow. An attacker can access internal network resources, retrieve sensitive information, or modify and...