Vendor
Flowise Unauthenticated RCE via Environment Variable Bypass
6 rules 11 TTPs 2 CVEsFlowise v3.1.2 and earlier are vulnerable to unauthenticated remote code execution because the CVE-2025-8943 patch relies on an incomplete environment variable blocklist, allowing attackers to inject configuration variables that force arbitrary package installation.
Flowise Authentication Bypass via Hardcoded JWT Secrets (CVE-2026-56271)
2 TTPs 1 CVEFlowise versions 3.0.13 and earlier are vulnerable due to hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience/issuer values ('AUDIENCE', 'ISSUER'), allowing an attacker to forge valid JWTs and impersonate any user, including administrators, leading to an authentication bypass if environment variables are not explicitly set.
Flowise 3.1.3 Arbitrary Code Execution Exploit Published
2 TTPsA critical arbitrary code execution vulnerability in Flowise version 3.1.3 and earlier has been publicly disclosed on Exploit-DB, enabling unauthenticated attackers to execute arbitrary commands on unpatched web application instances, leading to full system compromise.
CVE-2024-58351: Flowise Remote Code Execution via Configuration Injection
2 rules 7 TTPsFlowise versions before 2.1.4 are critically vulnerable to configuration injection (CVE-2024-58351) via the `overrideConfig` option in both its frontend web integration and backend Prediction API, which, due to a bypassable `vm2` sandbox, allows attackers to achieve remote code execution, sandbox escape, denial of service, server-side request forgery, prompt injection, and server variable/data exfiltration.
Flowise CSVAgent Authenticated Remote Code Execution
2 rules 1 TTPFlowise versions 3.0.13 and earlier are vulnerable to authenticated remote code execution due to missing sanitization in the CSVAgent component's customReadCSVFunc parameter, leading to arbitrary code injection and server compromise.
Flowise DocumentStore IDOR Vulnerability
2 rules 1 TTPA mass assignment vulnerability in the DocumentStore creation endpoint of Flowise allows authenticated users to control the primary key (id) and internal state fields of DocumentStore entities. By exploiting the implicit UPSERT operation, an attacker can overwrite existing DocumentStore objects, potentially leading to cross-workspace object takeover and broken object-level authorization (IDOR) in multi-tenant deployments.
Flowise Unauthenticated OAuth 2.0 Access Token Disclosure
2 rules 1 TTPFlowise versions 3.0.13 and earlier contain an authentication bypass vulnerability that allows an unauthenticated attacker to obtain OAuth 2.0 access tokens associated with a public chatflow.
Flowise Text-to-Speech API Credit Abuse via Unauthenticated Endpoint
2 rulesThe Flowise text-to-speech generation endpoint is vulnerable to unauthorized access due to accepting arbitrary credential IDs in the request body, enabling attackers to use victim's API keys for services like OpenAI and ElevenLabs, consume their API credits, and generate unlimited speech content at the victim's expense; this affects Flowise versions 3.0.13 and earlier.
Flowise resetPassword Authentication Bypass Vulnerability
2 rules 1 TTPFlowise version 3.0.12 is vulnerable to an authentication bypass vulnerability due to improper implementation of the password reset mechanism, allowing an attacker to reset a user's password and gain unauthorized access.
Flowise Public Chatflow Endpoint Exposes Sensitive Data
2 rules 2 TTPsFlowise versions 3.0.13 and earlier expose sensitive information, including credential IDs, plaintext API keys, and passwords, through the `GET /api/v1/public-chatflows/:id` endpoint, leading to account compromise and revealing internal architecture details.
FlowiseAI Flowise CSV Agent Prompt Injection RCE Vulnerability
2 rules 1 TTP 4 CVEsA remote code execution vulnerability exists in FlowiseAI Flowise version 3.0.13 due to insufficient sandboxing when evaluating LLM-generated Python scripts, allowing unauthenticated attackers to inject malicious code via prompts processed by the CSV Agent node, bypassing input validation, to execute arbitrary OS commands.