Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*

4 briefs RSS
high advisory

Authorization Bypass in Flowise openai-realtime Endpoints

Flowise versions prior to 3.1.4 contain an authorization flaw in the openai-realtime endpoint, enabling authenticated users to access and execute tools in unauthorized workspaces via cross-workspace ID manipulation.

Flowise vulnerability auth-bypass api-security
1c
critical advisory

Unauthenticated Account Takeover in Flowise via CVE-2025-58434

CVE-2025-58434 is a critical vulnerability in Flowise versions prior to 3.0.6 where the password reset API leaks a temporary token, enabling unauthenticated account takeover.

Flowise
1r 1t 1c
critical advisory

Flowise Unauthenticated RCE via Environment Variable Bypass

Flowise v3.1.2 and earlier are vulnerable to unauthenticated remote code execution because the CVE-2025-8943 patch relies on an incomplete environment variable blocklist, allowing attackers to inject configuration variables that force arbitrary package installation.

Flowise +6 rce injection cve-2026-69263 python-injection authentication-bypass oauth cve-2026-70478 web-vulnerability +7
6r 11t 8c 2i updated
critical advisory

FlowiseAI Flowise CSV Agent Prompt Injection RCE Vulnerability

A remote code execution vulnerability exists in FlowiseAI Flowise version 3.0.13 due to insufficient sandboxing when evaluating LLM-generated Python scripts, allowing unauthenticated attackers to inject malicious code via prompts processed by the CSV Agent node, bypassing input validation, to execute arbitrary OS commands.

Flowise +1 rce prompt-injection
2r 1t 4c updated