FlowiseAI Flowise
119 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-119978 | ≤ 3.1.4 | Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore | CRITICAL 9.0 | |||
| CVE-2026-100610 | ≤ 3.1.4 | Flowise through 3.1.4 Missing Authorization via upsert-history | HIGH 7.7 | 0.3 % | ||
| CVE-2026-100609 | ≤ 3.1.4 | Flowise through 3.1.4 Insecure Direct Object Reference via Credential | HIGH 7.6 | 0.3 % | ||
| CVE-2026-100608 | ≤ 3.1.4 | Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard | HIGH 8.7 | 0.3 % | ||
| CVE-2026-100607 | ≤ 3.1.4 | Flowise through 3.1.4 Authentication Bypass via Email-Only SSO | CRITICAL 9.2 | 0.4 % | ||
| CVE-2026-100606 | ≤ 3.1.4 | Flowise through 3.1.4 Authentication Bypass via SSO Email Match | CRITICAL 9.2 | 0.5 % | ||
| CVE-2026-100605 | ≤ 3.1.4 | Flowise through 3.1.4 Missing Authorization via Chat Message Routes | HIGH 7.5 | 0.3 % | ||
| CVE-2026-91938 | < 3.1.4 | Flowise before 3.1.4 Server-Side Request Forgery via document loaders | HIGH 7.6 | 0.4 % | ||
| CVE-2026-91937 | < 3.1.4 | Flowise before 3.1.4 NoSQL Injection via sessionId | HIGH 8.7 | 0.5 % | ||
| CVE-2026-91936 | < 3.1.4 | Flowise before 3.1.4 Script Injection via Docker Workflows | HIGH 8.3 | 0.5 % | ||
| CVE-2026-91935 | < 3.1.4 | Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes | HIGH 8.7 | 0.4 % | ||
| CVE-2026-91934 | < 3.1.4 | Flowise before 3.1.4 Remote Code Execution via SQL Database Chain | HIGH 8.7 | 0.7 % | ||
| CVE-2026-91933 | < 3.1.4 | Flowise before 3.1.4 Authorization Bypass via openai-realtime | HIGH 7.6 | 0.4 % | ||
| CVE-2026-91932 | < 3.1.4 | Flowise before 3.1.4 Remote Code Execution via cwd Parameter | CRITICAL 9.0 | 0.7 % | ||
| CVE-2026-91931 | < 3.1.4 | Flowise before 3.1.4 Remote Code Execution via Custom MCP npx | CRITICAL 9.0 | 0.7 % | ||
| CVE-2026-91930 | < 3.1.4 | Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover | HIGH 7.7 | 0.4 % | ||
| CVE-2026-91929 | < 3.1.4 | Flowise before 3.1.4 Cross-Tenant Authorization Bypass | HIGH 7.6 | 0.4 % | ||
| CVE-2026-90580 | 3.0.0 ; 3.0.1 ; 3.0.2 | FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-90535 | < 3.1.4 | Flowise before 3.1.4 Denial of Service via text-to-speech/abort | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-90534 | < 3.1.4 | Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method | MEDIUM 6.1 | 0.4 % | ||
| CVE-2026-90533 | < 3.1.4 | Flowise before 3.1.4 Broken Access Control via organizationuser | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-73604 | < 3.1.3 | Flowise before 3.1.3 Credential Exposure via API | HIGH 7.1 | 0.4 % | ||
| CVE-2026-73603 | < 3.1.4 | Flowise before 3.1.4 Credential Abuse via Text-to-Speech | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-73602 | < 3.1.3 | Flowise before 3.1.3 Sandbox Escape to RCE | CRITICAL 9.0 | 0.8 % | ||
| CVE-2026-73601 | < 3.1.3 | Flowise before 3.1.3 Remote Code Execution via Custom MCP | CRITICAL 9.0 | 1.1 % | ||
| CVE-2026-73488 | < 3.1.3 | Flowise before 3.1.3 IDOR via customer-default-source endpoint | MEDIUM 6.0 | 0.4 % | ||
| CVE-2026-73487 | < 3.1.3 | Flowise before 3.1.3 Prompt Injection RCE via CSV Agent | CRITICAL 9.0 | 1.0 % | ||
| CVE-2026-73486 | < 3.1.3 | Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV | CRITICAL 9.0 | 0.7 % | ||
| CVE-2026-73485 | < 3.1.3 | Flowise before 3.1.3 Remote Code Execution via Airtable Agent | CRITICAL 9.0 | 0.6 % | ||
| CVE-2026-73484 | < 3.1.3 | Flowise before 3.1.3 Sandbox Escape via Pandas Methods | HIGH 8.6 | 0.4 % | ||
| CVE-2026-73483 | < 3.1.3 | Flowise before 3.1.3 Sandbox Escape via Puppeteer | CRITICAL 9.4 | 0.6 % | ||
| CVE-2026-71962 | 2.2.4 – 3.1.4 | Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download | HIGH 8.7 | 0.7 % | ||
| CVE-2026-67620 | ≤ 3.1.4 | Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-70636 | ≤ 3.1.4 | Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint | HIGH 8.7 | 0.7 % | ||
| CVE-2026-67622 | ≤ 3.1.4 | Flowise 3.1.4 IDOR in OpenAI Assistants Integration | HIGH 8.5 | 0.5 % | ||
| CVE-2026-67621 | ≤ 3.1.4 | Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints | HIGH 7.2 | 0.4 % | ||
| CVE-2026-70478 | < 3.1.2 | Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service | CRITICAL 9.2 | 0.6 % | ||
| CVE-2026-70477 | < 3.1.2 | Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | CRITICAL 9.5 | 0.8 % | ||
| CVE-2026-70476 | < 3.1.2 | Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation | HIGH 8.3 | 0.5 % | ||
| CVE-2026-70475 | < 3.1.2 | Flowise: Missing Authorization on Execution Update Endpoint | HIGH 7.1 | 0.5 % | ||
| CVE-2026-70474 | < 3.1.3 | Flowise: Cross-Workspace OAuth2 Credential Metadata Leak | HIGH 7.6 | 0.5 % | ||
| CVE-2026-70473 | < 3.1.3 | Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history | HIGH 8.3 | 0.5 % | ||
| CVE-2026-70472 | < 3.1.3 | Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store | HIGH 7.1 | 0.5 % | ||
| CVE-2026-70471 | < 3.1.3 | Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure | HIGH 7.1 | 0.4 % | ||
| CVE-2026-70470 | < 3.1.3 | Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE | CRITICAL 9.5 | 1.0 % | ||
| CVE-2026-69264 | < 3.1.3 | Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation | CRITICAL 9.4 | 1.1 % | ||
| CVE-2026-69263 | < 3.1.3 | Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) | HIGH 8.7 | 0.7 % | ||
| CVE-2026-69262 | < 3.1.3 | Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete ea… | HIGH 7.1 | 0.5 % | ||
| CVE-2026-69259 | < 3.1.3 | Flowise RCE via SQLite Record Manager Node | CRITICAL 9.4 | 0.8 % | ||
| CVE-2026-69258 | < 3.1.3 | Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API | HIGH 8.8 | 0.7 % | ||
| CVE-2026-69257 | < 3.1.3 | Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses | HIGH 7.6 | 0.4 % | ||
| CVE-2026-69256 | < 3.1.3 | Flowise: Remote Code Execution Vulnerability in CSVAgent | CRITICAL 9.4 | 1.0 % | ||
| CVE-2026-69255 | < 3.1.3 | Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified | CRITICAL 9.2 | 0.6 % | ||
| CVE-2026-69254 | < 3.1.3 | Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override | CRITICAL 9.4 | 0.7 % | ||
| CVE-2026-69253 | < 3.1.3 | Flowise Sandbox Escape to RCE | CRITICAL 9.0 | 0.7 % | ||
| CVE-2026-69252 | < 3.1.3 | Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the sa… | HIGH 7.2 | 0.5 % | ||
| CVE-2026-69251 | < 3.1.3 | Flowise RCE via TypeORM DataSource | CRITICAL 9.0 | 2.7 % | ||
| CVE-2026-69250 | < 3.1.3 | Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration | HIGH 8.5 | 0.6 % | ||
| CVE-2026-12821 | 3.1.0 ; 3.1.1 ; 3.1.2 | FlowiseAI Flowise S3 Document Loader S3.ts path traversal | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-46480 | < 3.1.2 | Flowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover | HIGH 7.7 | 0.3 % | ||
| CVE-2026-46479 | < 3.1.2 | Flowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover | HIGH 7.7 | 0.3 % | ||
| CVE-2026-46478 | < 3.1.2 | Flowise: DatasetRow create+update mass-assignment allows cross-workspace row takeover | HIGH 7.7 | 0.3 % | ||
| CVE-2026-46477 | < 3.1.2 | Flowise: Dataset create+update mass-assignment allows cross-workspace dataset takeover | HIGH 7.7 | 0.3 % | ||
| CVE-2026-46476 | < 3.1.2 | Flowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeover | HIGH 7.7 | 0.3 % | ||
| CVE-2026-46475 | < 3.1.2 | Flowise: Assistant create+update mass-assignment allows cross-workspace assistant takeover | HIGH 7.7 | 0.3 % | ||
| CVE-2026-46443 | < 3.1.2 | Flowise: Credential Data Leak | HIGH 7.0 | 0.3 % | ||
| CVE-2026-46442 | < 3.1.2 | Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape | CRITICAL 9.4 | 36 % | ||
| CVE-2026-46441 | < 3.1.2 | Flowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment | HIGH 7.6 | 0.3 % | ||
| CVE-2026-46440 | < 3.1.2 | Flowise: Basic Auth Credentials Exposed via API | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-42863 | < 3.1.2 | Flowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment | HIGH 7.6 | 0.3 % | ||
| CVE-2026-42862 | < 3.1.2 | Flowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment | HIGH 7.6 | 0.2 % | ||
| CVE-2026-42861 | < 3.1.2 | Flowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignment | HIGH 7.6 | 0.3 % | ||
| CVE-2026-46444 | < 3.1.2 | Flowise: Vector Store No Permission Checks | HIGH 8.7 | 0.3 % | ||
| CVE-2026-43995 | < 3.1.0 | Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-8028 | 3.0.0 ; 3.0.1 ; 3.0.2 ; … | FlowiseAI Flowise Endpoint account.service.ts verify information disclosure | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-8027 | 3.0.0 ; 3.0.1 ; 3.0.2 ; … | FlowiseAI Flowise User Controller authorization | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-8026 | 3.0.0 ; 3.0.1 ; 3.0.2 ; … | FlowiseAI Flowise API Response account.service.ts login information disclosure | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-41274 | < 3.1.0 | Flowise: Cypher Injection in GraphCypherQAChain | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-41264 | < 3.1.0 | Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | CRITICAL 9.2 | 1.8 % | ||
| CVE-2026-41265 | < 3.1.0 | Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability | CRITICAL 9.2 | 0.6 % | ||
| CVE-2026-41279 | < 3.1.0 | Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials | HIGH 8.2 | 0.3 % | ||
| CVE-2026-41278 | < 3.1.0 | Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs | HIGH 8.7 | 0.4 % | ||
| CVE-2026-41276 | < 3.1.0 | Flowise: AccountService resetPassword Authentication Bypass Vulnerability | HIGH 7.7 | 6.9 % | ||
| CVE-2026-41277 | < 3.1.0 | Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR) | HIGH 7.6 | 3.1 % | ||
| CVE-2026-41275 | < 3.1.0 | Flowise: Password Reset Link Sent Over Unsecured HTTP | HIGH 7.5 | 0.2 % | ||
| CVE-2026-41273 | < 3.1.0 | Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow | HIGH 7.7 | 0.3 % | ||
| CVE-2026-41271 | < 3.1.0 | Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains | HIGH 8.3 | 0.2 % | ||
| CVE-2026-41272 | < 3.1.0 | Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) | HIGH 7.1 | 0.3 % | ||
| CVE-2026-41270 | < 3.1.0 | Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox | HIGH 8.3 | 0.2 % | ||
| CVE-2026-41269 | < 3.1.0 | Flowise: File Upload Validation Bypass in createAttachment | HIGH 8.8 | 0.5 % | ||
| CVE-2026-41268 | < 3.1.0 | Flowise: Flowise Parameter Override Bypass Remote Command Execution | CRITICAL 9.8 | 17 % | ||
| CVE-2026-41267 | < 3.1.0 | Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-41266 | < 3.1.0 | Flowise: Sensitive Data Leak in public-chatbotConfig | HIGH 7.7 | 4.1 % | ||
| CVE-2026-41137 | < 3.1.0 | Flowise: Code Injection in CSVAgent leads to Authenticated RCE | CRITICAL 9.4 | 1.5 % | ||
| CVE-2026-41138 | < 3.1.0 | Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas. | HIGH 8.8 | 0.6 % | ||
| CVE-2026-40933 | < 3.1.0 | Flowise: Authenticated RCE Via MCP Adapters | CRITICAL 10.0 | 12 % | ||
| CVE-2026-31829 | < 3.0.13 | Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access | HIGH 8.8 | 2.4 % | ||
| CVE-2026-30824 | < 3.0.13 | Flowise: Missing Authentication on NVIDIA NIM Endpoints | HIGH 7.7 | 37 % | ||
| CVE-2026-30823 | < 3.0.13 | Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration | HIGH 8.8 | 0.4 % | ||
| CVE-2026-30822 | < 3.0.13 | Flowise: Mass Assignment in `/api/v1/leads` Endpoint | HIGH 7.7 | 13 % | ||
| CVE-2026-30821 | < 3.0.13 | Flowise: Arbitrary File Upload via MIME Spoofing | HIGH 8.2 | 15 % | ||
| CVE-2026-30820 | < 3.0.13 | Flowise Authorization Bypass via Spoofed x-request-from Header | HIGH 8.7 | 0.5 % | ||
| CVE-2025-34267 | 3.0.1 – 3.0.8 | Flowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packages | HIGH 8.4 | 6.6 % | ||
| CVE-2025-61913 | < 3.0.8 | Flowise is vulnerable to arbitrary file read, arbitrary file write | CRITICAL 10.0 | 14 % | ||
| CVE-2025-61687 | = 3.0.7 | FlowiseAI/Flosise has File Upload vulnerability | HIGH 8.8 | 12 % | ||
| CVE-2025-50538 | < 3.0.5 | Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log. | HIGH 8.2 | 15 % | ||
| CVE-2025-29192 | < 3.0.5 | Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log. | HIGH 8.2 | 0.4 % | ||
| CVE-2025-59528 | = 3.0.5 | Flowise has Remote Code Execution vulnerability | CRITICAL 10.0 | 86 % | ||
| CVE-2025-59527 | = 3.0.5 | FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability | HIGH 7.5 | 5.2 % | ||
| CVE-2025-59434 | < cloud-hosted (as of Aug 2025) | Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function | CRITICAL 9.6 | 3.6 % | ||
| CVE-2025-58434 | <= 3.0.5 | Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover | CRITICAL 9.8 | 76 % | ||
| CVE-2024-8181 | 1.8.2 | Flowise Authentication Bypass | CRITICAL 9.8 | 45 % | ||
| CVE-2024-8182 | 1.8.2 | Flowise Denial of Service | HIGH 7.5 | 14 % | ||
| CVE-2024-37146 | <= 1.4.3 | GHSL-2023-248: Flowise xss in /api/v1/credentials/id | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-37145 | <= 1.4.3 | GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id | MEDIUM 6.1 | 0.5 % | ||
| CVE-2024-36423 | <= 1.4.3 | GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/id | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-36422 | <= 1.4.3 | GHSL-2023-245: Flowise xss in api/v1/chatflows/id | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-36421 | <= 1.4.3 | GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts | HIGH 7.5 | 8.5 % | ||
| CVE-2024-36420 | <= 1.4.3 | GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file | HIGH 7.5 | 1.8 % |