Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Flowise — Vulnerabilities & Security Advisories 143

All 143 CVE vulnerabilities found in Flowise, with AI-generated Chinese analysis, references, and POCs.

This page documents known security vulnerabilities associated with the open-source orchestration framework Flowise, categorized under common weakness types such as improper input validation and authorization failures. The collection aggregates public disclosure records, vendor advisories, and community-reported issues ranging from the project's initial release through recent updates, providing a comprehensive historical view of its security posture. Here, you can track a vendor's advisories to understand the timeline and remediation efforts behind specific patches, understand a weakness class by observing how certain architectural patterns in LLM orchestration tools manifest as exploitable bugs, or look up a product's vulnerability history to assess its stability and risk profile over time. This resource serves as a neutral reference for security researchers, developers, and enterprise buyers evaluating Flowise for deployment in production environments. By centralizing disparate sources of vulnerability data, the page eliminates the need to search multiple CVE databases or project repositories individually. Users can analyze trends in bug reports, compare the frequency of critical severity issues against less severe findings, and review the effectiveness of past security responses. The data is structured to facilitate quick retrieval of relevant information without requiring deep knowledge of the underlying codebase, enabling stakeholders to make informed decisions regarding risk mitigation and upgrade strategies.

Vendor: FlowiseAI

CVE ID Title CVSS Severity Published
CVE-2026-100610 Flowise through 3.1.4 Missing Authorization via upsert-history CWE-639 7.5 High 2026-09-26
CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential CWE-639 6.8 Medium 2026-09-26
CVE-2026-100608 Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard CWE-862 8.3 High 2026-09-26
CVE-2026-100607 Flowise through 3.1.4 Authentication Bypass via Email-Only SSO CWE-287 7.7 High 2026-09-26
CVE-2026-100606 Flowise through 3.1.4 Authentication Bypass via SSO Email Match CWE-287 7.7 High 2026-09-26
CVE-2026-100605 Flowise through 3.1.4 Missing Authorization via Chat Message Routes CWE-862 7.1 High 2026-09-26
CVE-2026-91938 Flowise before 3.1.4 Server-Side Request Forgery via document loaders CWE-918 7.1 High 2026-09-15
CVE-2026-91937 Flowise before 3.1.4 NoSQL Injection via sessionId CWE-943 7.5 High 2026-09-15
CVE-2026-91936 Flowise before 3.1.4 Script Injection via Docker Workflows CWE-78 6.8 Medium 2026-09-15
CVE-2026-91935 Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes CWE-918 8.3 High 2026-09-15
CVE-2026-91934 Flowise before 3.1.4 Remote Code Execution via SQL Database Chain CWE-22 8.8 High 2026-09-15
CVE-2026-91933 Flowise before 3.1.4 Authorization Bypass via openai-realtime CWE-639 7.1 High 2026-09-15
CVE-2026-91932 Flowise before 3.1.4 Remote Code Execution via cwd Parameter CWE-20 8.5 High 2026-09-15
CVE-2026-91931 Flowise before 3.1.4 Remote Code Execution via Custom MCP npx CWE-78 8.5 High 2026-09-15
CVE-2026-91930 Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover CWE-266 7.5 High 2026-09-15
CVE-2026-91929 Flowise before 3.1.4 Cross-Tenant Authorization Bypass CWE-862 7.1 High 2026-09-15
CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery CWE-918 6.3 Medium 2026-09-13
CVE-2026-90535 Flowise before 3.1.4 Denial of Service via text-to-speech/abort CWE-862 6.3 Medium 2026-09-12
CVE-2026-90534 Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method CWE-639 6.1 Medium 2026-09-12
CVE-2026-90533 Flowise before 3.1.4 Broken Access Control via organizationuser CWE-862 6.0 Medium 2026-09-12
CVE-2026-73604 Flowise before 3.1.3 Credential Exposure via API CWE-200 6.5 Medium 2026-08-13
CVE-2026-73602 Flowise before 3.1.3 Sandbox Escape to RCE CWE-95 9.0 Critical 2026-08-13
CVE-2026-73603 Flowise before 3.1.4 Credential Abuse via Text-to-Speech CWE-862 6.3 Medium 2026-08-13
CVE-2026-73601 Flowise before 3.1.3 Remote Code Execution via Custom MCP CWE-95 9.0 Critical 2026-08-13
CVE-2026-73488 Flowise before 3.1.3 IDOR via customer-default-source endpoint CWE-639 6.0 Medium 2026-08-13
CVE-2026-73487 Flowise before 3.1.3 Prompt Injection RCE via CSV Agent CWE-94 9.0 Critical 2026-08-13
CVE-2026-73486 Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV CWE-94 9.0 Critical 2026-08-13
CVE-2026-73484 Flowise before 3.1.3 Sandbox Escape via Pandas Methods CWE-184 8.6 High 2026-08-13
CVE-2026-73485 Flowise before 3.1.3 Remote Code Execution via Airtable Agent CWE-94 9.0 Critical 2026-08-13
CVE-2026-73483 Flowise before 3.1.3 Sandbox Escape via Puppeteer CWE-78 9.4 Critical 2026-08-13

All 143 known CVE vulnerabilities affecting Flowise with full Chinese analysis, references, and POCs where available.