By vendor

Flowiseai vulnerabilities

Known CVEs affecting Flowiseai products, prioritized by severity, with SEC.co remediation and detection guidance.

23 published vulnerabilities

• CVE-2026-46444HIGH 8.8

  Flowise versions prior to 3.1.2 contain a critical authentication flaw in the OpenAI Assistants Vector Store endpoints. Any authenticated user with a valid API key can perform unrestricted create, read, update, and delete operations on vector store data without additional permission checks. This means a low-privileged user or compromised API key can manipulate vector stores that should only be accessible to specific users or administrative roles.

• CVE-2026-46475HIGH 8.8

  Flowise, a platform for building customized LLM workflows through a drag-and-drop interface, contains a privilege escalation vulnerability in its assistant management features. Prior to version 3.1.2, an authenticated attacker can exploit mass-assignment flaws in the create and update endpoints to take over assistants belonging to other workspaces, potentially accessing or modifying shared LLM configurations across organizational boundaries.

• CVE-2026-46476HIGH 8.8

  Flowise, a visual tool for building customized large language model workflows, contains a vulnerability in how it handles template creation and updates. Attackers with user access can exploit mass-assignment flaws to take control of templates across different workspaces—essentially hijacking template configurations that should be isolated from one another. The vulnerability affects all versions prior to 3.1.2 and has been resolved in that release.

• CVE-2026-46477HIGH 8.8

  Flowise, a visual interface for building and customizing language model workflows, contains a mass-assignment vulnerability in its dataset management functions. Before version 3.1.2, an authenticated attacker could exploit weak input validation during dataset creation or updates to access and modify datasets across different workspaces—effectively taking over datasets belonging to other users or teams. The vulnerability requires a valid user account to exploit but poses a serious risk to multi-tenant Flowise deployments where data isolation is critical.

• CVE-2026-46478HIGH 8.8

  Flowise, a popular drag-and-drop interface for building customized language model workflows, contains a privilege escalation flaw in its DatasetRow functionality. Before version 3.1.2, an authenticated attacker could manipulate how new dataset rows are created or updated, allowing them to inject or modify rows belonging to other workspaces. This mass-assignment vulnerability effectively grants an attacker control over another organization's data within the same Flowise deployment, provided they have valid login credentials.

• CVE-2026-46479HIGH 8.8

  Flowise, a no-code platform for building customized LLM workflows, contains a privilege escalation vulnerability in its evaluation management system. Attackers with valid user credentials can modify evaluation records in ways that bypass workspace isolation, allowing them to view, edit, or delete evaluations belonging to other teams or organizations. The vulnerability stems from improper input validation in the create and update endpoints—a classic mass-assignment flaw. Version 3.1.2 and later patch this issue.

• CVE-2026-46480HIGH 8.8

  Flowise, a no-code platform for building customized large language model workflows, contains a privilege escalation vulnerability in its evaluator management feature. An authenticated attacker can exploit improper input validation during evaluator creation or updates to gain unauthorized access to evaluators across different workspaces. This allows an attacker to take over evaluators belonging to other users or teams, potentially manipulating AI workflow logic and data without authorization. The vulnerability requires an existing login but no elevated privileges to exploit.

• CVE-2025-71328HIGH 8.3

  Flowise, a low-code AI workflow platform, contains a password change vulnerability affecting versions before 3.0.10. An authenticated attacker can reset a user's account password without providing the current password or undergoing additional verification. This means if an attacker gains access to an active session—through phishing, social engineering, or session hijacking—they can silently change the password and permanently lock out the legitimate user, achieving full account takeover.

• CVE-2025-71337HIGH 8.3

  Flowise versions 3.0.7 and earlier contain a flaw that lets any logged-in user change their account email address without verifying the change with the original email or re-entering their password. Since email serves as both the login identifier and the channel for password recovery, an attacker with account access can silently redirect recovery emails to an attacker-controlled address, enabling complete account takeover. This is a high-severity issue because it removes critical safeguards that normally protect email changes—the two most common identity verification methods in web applications.

• CVE-2025-71335HIGH 8.1

  Flowise, a workflow automation platform, contains a critical session management flaw affecting versions 3.0.7 and earlier. When a user changes their password, the application fails to terminate existing login sessions or invalidate previously issued session tokens. This means an attacker with an active session—whether obtained through a stolen token or an unattended logged-in device—retains full access to that user's account even after the legitimate user has rotated their credentials. The attacker can continue operating as the authenticated user without any disruption, completely defeating the protective intent of a password change.

• CVE-2026-42863HIGH 8.1

  FlowiseAI versions prior to 3.1.2 contain a mass assignment vulnerability in their chatflow update feature. An authenticated user can modify internal system properties—such as workspace assignment, deployment status, and visibility settings—that should only be controlled by administrators. This allows attackers to reassign workflows to other workspaces, change deployment states without authorization, and alter public/private visibility of chatflows. The vulnerability requires valid login credentials but no additional special access.

• CVE-2026-56268HIGH 7.7

  Flowise, a popular open-source platform for building conversational AI applications, has an information disclosure flaw in versions before 3.1.2. An attacker with a valid API key to one workspace can query an unprotected endpoint and retrieve sensitive configuration details—including system prompts, node settings, and credential IDs—from chatflows across other workspaces that lack API key protection. This occurs because the API endpoint fails to enforce workspace boundaries when returning chatflow data.

• CVE-2025-71324HIGH 7.5

  Flowise, an open-source platform for building conversational AI applications, contains a flaw that allows unauthenticated attackers to read files from the server hosting it. The vulnerability exists in file-download endpoints that accept a chatId parameter without properly validating or restricting where files can be retrieved from. An attacker can manipulate this parameter to escape the intended storage directory and access sensitive files elsewhere on the system—most critically, the application's SQLite database, which contains user credentials, conversation histories, and other sensitive data. No user interaction or authentication is required to exploit this.

• CVE-2026-56270HIGH 7.5

  Flowise, a popular open-source workflow automation platform, contains an unauthenticated information disclosure vulnerability that allows attackers to retrieve sensitive OAuth and SSO configuration details without logging in. By making a simple request to a specific API endpoint with an organization ID, an attacker can harvest OAuth client secrets for major identity providers including Google, Microsoft Azure, GitHub, and Auth0. This flaw affects Flowise versions 3.0.13 and earlier; version 3.1.0 and later include fixes. Organizations running Flowise—whether as a cloud service or self-hosted—with this endpoint exposed are at immediate risk of credential compromise.

• CVE-2026-56275HIGH 7.1

  Flowise versions before 3.1.0 contain a server-side request forgery (SSRF) vulnerability in the Execute Flow node. An authenticated attacker can manipulate the base URL field to bypass security controls and force the application to make HTTP requests to internal network addresses, cloud metadata endpoints, and other sensitive systems that should not be directly accessible. This allows reconnaissance and potential lateral movement within your infrastructure.

• CVE-2025-71332MEDIUM 6.5

  Flowise, a popular workflow automation platform, contains a SQL injection vulnerability in its chatflow import feature. An authenticated attacker can upload a specially crafted JSON file that executes arbitrary SQL commands on the backend database. The vulnerability stems from a failure to properly sanitize the chatflow ID before inserting it into a SQL query. While authentication is required to exploit this issue, the impact is significant: attackers can extract sensitive data from the credential table, potentially compromising stored API keys, passwords, and other authentication tokens used by the platform.

• CVE-2026-46443MEDIUM 6.5

  Flowise, a no-code platform for building custom language model workflows, contains a credential exposure flaw in versions before 3.1.2. When users or applications retrieve stored credentials using a filter parameter, the system fails to remove encrypted credential data from the response—information that should never leave the server. An attacker with legitimate access to the Flowise instance could exploit this to extract encrypted credentials, potentially compromising downstream services or enabling lateral movement. The vulnerability does not affect credential retrieval when no filter is applied, indicating incomplete input-handling logic.

• CVE-2026-56277MEDIUM 6.5

  Flowise versions before 3.1.2 contain a cross-origin request forgery vulnerability in their text-to-speech endpoint. The affected endpoint incorrectly permits any website to trigger TTS generation by hardcoding the CORS header to accept all origins (*), bypassing the application's otherwise secure default settings. An attacker can craft a malicious webpage that, when visited by a logged-in Flowise user, silently generates speech synthesis requests using that user's stored session credentials—a technique known as cross-origin credential abuse.

• CVE-2025-71331MEDIUM 6.1

  Flowise, a platform for building AI chat applications, has a cross-site scripting (XSS) weakness in versions before 3.0.8. An attacker can inject malicious code through chat messages or custom agent functions, which then runs in a victim's browser when they interact with an affected Flowise instance. This could allow theft of session cookies and authentication tokens, potentially giving attackers unauthorized access to user accounts or sensitive data the victim can access.

• CVE-2026-42862MEDIUM 5.0

  Flowise, a popular drag-and-drop interface for building custom AI language model workflows, contains a security flaw that allows authenticated users to move tools between workspaces without proper authorization. When updating a tool, the application fails to validate who should have permission to change ownership fields like workspaceId. An attacker with legitimate access to one workspace can reassign tools to a different workspace, potentially exposing or stealing AI workflows, data pipelines, or proprietary configurations belonging to another team or customer. This breaks the isolation that multi-workspace Flowise deployments rely on to keep organizations separate.

• CVE-2026-58057MEDIUM 5.0

  Flowise, a visual AI workflow platform, contains a vulnerability in how it validates environment variables for custom integrations on Windows systems. Attackers with legitimate access to configure workflow nodes can bypass security restrictions by using a lowercase variant of a blocked environment variable, allowing them to execute arbitrary code on the Flowise server. This requires authentication and administrator-level access to the workflow configuration interface.

• CVE-2026-56269MEDIUM 4.6

  Flowise, a popular open-source workflow automation platform, contains a hardcoded encryption secret in versions 3.0.13 and earlier. When administrators don't explicitly configure the TOKEN_HASH_SECRET environment variable, the application defaults to a publicly known weak value ('Secre$t'). This secret is used to encrypt sensitive metadata (user IDs and workspace IDs) embedded within authentication tokens. An attacker who discovers or deploys Flowise with this default secret can decrypt the metadata to learn internal identifiers and potentially manipulate them. While this alone doesn't bypass authentication, it could facilitate privilege escalation or lateral movement by revealing system structure and enabling token forgery attempts.

• CVE-2026-56272MEDIUM 4.1

  Flowise versions before 3.0.13 use weak password hashing configuration that makes user account credentials significantly easier to crack if a database is compromised. The application relies on bcrypt with only 5 salt rounds (32 iterations), whereas security best practices call for at least 10 rounds. This 30x speed advantage in cracking attempts means attackers with GPU hardware can recover plaintext passwords from stolen hashes much faster than intended.