FlowiseAI vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-100610 Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service perHigh 7.7 · Sep 26, 2026
• CVE-2026-100609 Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneHigh 7.6 · Sep 26, 2026
• CVE-2026-100608 Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard.High 8.7 · Sep 26, 2026
• CVE-2026-100607 Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to autheCritical 9.2 · Sep 26, 2026
• CVE-2026-100606 Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path.Critical 9.2 · Sep 26, 2026
• CVE-2026-100605 Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history.High 7.5 · Sep 26, 2026
• CVE-2026-91938 Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF pHigh 7.6 · Sep 15, 2026
• CVE-2026-91937 Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node.High 8.7 · Sep 15, 2026
• CVE-2026-91936 Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated High 8.3 · Sep 15, 2026
• CVE-2026-91935 Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts.High 8.7 · Sep 15, 2026
• CVE-2026-91934 Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers tHigh 8.7 · Sep 15, 2026
• CVE-2026-91933 Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFHigh 7.6 · Sep 15, 2026
• CVE-2026-91932 Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unCritical 9 · Sep 15, 2026
• CVE-2026-91931 Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by suppCritical 9 · Sep 15, 2026
• CVE-2026-91930 Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitraHigh 7.7 · Sep 15, 2026
• CVE-2026-91929 Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations.High 7.6 · Sep 15, 2026
• CVE-2026-52098 An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpointCritical 9.8 · Sep 10, 2026
• CVE-2026-73604 Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaHigh 7.1 · Aug 13, 2026
• CVE-2026-73602 Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploitiCritical 9 · Aug 13, 2026
• CVE-2026-73601 Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticaCritical 9 · Aug 13, 2026
• CVE-2026-73487 Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicioCritical 9 · Aug 13, 2026
• CVE-2026-73486 Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbiCritical 9 · Aug 13, 2026
• CVE-2026-73485 Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code bCritical 9 · Aug 13, 2026
• CVE-2026-73484 Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json,High 8.6 · Aug 13, 2026
• CVE-2026-73483 Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox.Critical 9.4 · Aug 13, 2026