Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Flowise — Vulnerabilities & Security Advisories 144

All 144 CVE vulnerabilities found in Flowise, with AI-generated Chinese analysis, references, and POCs.

This page documents known security vulnerabilities associated with the open-source orchestration framework Flowise, categorized under common weakness types such as improper input validation and authorization failures. The collection aggregates public disclosure records, vendor advisories, and community-reported issues ranging from the project's initial release through recent updates, providing a comprehensive historical view of its security posture. Here, you can track a vendor's advisories to understand the timeline and remediation efforts behind specific patches, understand a weakness class by observing how certain architectural patterns in LLM orchestration tools manifest as exploitable bugs, or look up a product's vulnerability history to assess its stability and risk profile over time. This resource serves as a neutral reference for security researchers, developers, and enterprise buyers evaluating Flowise for deployment in production environments. By centralizing disparate sources of vulnerability data, the page eliminates the need to search multiple CVE databases or project repositories individually. Users can analyze trends in bug reports, compare the frequency of critical severity issues against less severe findings, and review the effectiveness of past security responses. The data is structured to facilitate quick retrieval of relevant information without requiring deep knowledge of the underlying codebase, enabling stakeholders to make informed decisions regarding risk mitigation and upgrade strategies.

Vendor: FlowiseAI

CVE ID Title CVSS Severity Published
CVE-2026-56278 Flowise - Session Hijacking via Weak Default Express Session Secret CWE-798 9.1 Critical 2026-06-30
CVE-2026-56277 Flowise - Hardcoded CORS Wildcard in TTS Endpoint CWE-346 - - 2026-06-30
CVE-2026-58057 Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity CWE-178 5.0 Medium 2026-06-28
CVE-2025-71336 Flowise - Unsandboxed Remote Code Execution via Custom MCP CWE-78 9.8 Critical 2026-06-25
CVE-2025-71338 Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API CWE-73 10.0 Critical 2026-06-25
CVE-2025-71335 Flowise - Session Invalidation Failure After Password Change CWE-613 8.1 High 2026-06-25
CVE-2025-71334 Flowise - Arbitrary File Access via Missing Chat Flow ID Validation CWE-73 9.8 Critical 2026-06-25
CVE-2025-71333 Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint CWE-73 - - 2026-06-25
CVE-2025-71328 Flowise - Unverified Password Change via Account Settings CWE-620 8.3 High 2026-06-25
CVE-2025-71327 Flowise - Authentication Bypass via Unprotected Registration Endpoint CWE-306 9.1 Critical 2026-06-25
CVE-2025-71324 Flowise - Arbitrary File Read via chatId Parameter CWE-73 7.5 High 2026-06-25
CVE-2026-56272 Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing CWE-916 4.1 Medium 2026-06-24
CVE-2026-56270 Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint CWE-306 7.5 High 2026-06-24
CVE-2026-56269 Flowise - Weak Default Token Hash Secret in JWT Token Encryption CWE-798 4.6 Medium 2026-06-24
CVE-2025-71332 Flowise - SQL Injection in importChatflows API via chatflow.id Parameter CWE-89 6.5 Medium 2026-06-24
CVE-2026-56274 Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess CWE-78 9.9 Critical 2026-06-23
CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL CWE-918 - - 2026-06-23
CVE-2025-71337 Flowise - Unverified Email Change via Account Profile Endpoint CWE-620 8.3 High 2026-06-23
CVE-2026-56268 Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint CWE-863 7.7 High 2026-06-22
CVE-2026-12821 FlowiseAI Flowise S3 Document Loader S3.ts path traversal CWE-22 6.3 Medium 2026-06-21
CVE-2026-56276 Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override CWE-915 - - 2026-06-20
CVE-2026-56267 Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint CWE-200 - - 2026-06-20
CVE-2025-71331 Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows CWE-80 6.1 Medium 2026-06-20
CVE-2024-58351 Flowise - Remote Code Execution via overrideConfig Parameter CWE-94 9.8 Critical 2026-06-20
CVE-2026-46480 Flowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover CWE-915 - - 2026-06-08
CVE-2026-46479 Flowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover CWE-915 - - 2026-06-08
CVE-2026-46478 Flowise: DatasetRow create+update mass-assignment allows cross-workspace row takeover CWE-915 - - 2026-06-08
CVE-2026-46477 Flowise: Dataset create+update mass-assignment allows cross-workspace dataset takeover CWE-915 - - 2026-06-08
CVE-2026-46476 Flowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeover CWE-915 - - 2026-06-08
CVE-2026-46475 Flowise: Assistant create+update mass-assignment allows cross-workspace assistant takeover CWE-915 - - 2026-06-08

All 144 known CVE vulnerabilities affecting Flowise with full Chinese analysis, references, and POCs where available.