Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Flowise — Vulnerabilities & Security Advisories 144

All 144 CVE vulnerabilities found in Flowise, with AI-generated Chinese analysis, references, and POCs.

This page documents known security vulnerabilities associated with the open-source orchestration framework Flowise, categorized under common weakness types such as improper input validation and authorization failures. The collection aggregates public disclosure records, vendor advisories, and community-reported issues ranging from the project's initial release through recent updates, providing a comprehensive historical view of its security posture. Here, you can track a vendor's advisories to understand the timeline and remediation efforts behind specific patches, understand a weakness class by observing how certain architectural patterns in LLM orchestration tools manifest as exploitable bugs, or look up a product's vulnerability history to assess its stability and risk profile over time. This resource serves as a neutral reference for security researchers, developers, and enterprise buyers evaluating Flowise for deployment in production environments. By centralizing disparate sources of vulnerability data, the page eliminates the need to search multiple CVE databases or project repositories individually. Users can analyze trends in bug reports, compare the frequency of critical severity issues against less severe findings, and review the effectiveness of past security responses. The data is structured to facilitate quick retrieval of relevant information without requiring deep knowledge of the underlying codebase, enabling stakeholders to make informed decisions regarding risk mitigation and upgrade strategies.

Vendor: FlowiseAI

CVE ID Title CVSS Severity Published
CVE-2026-46443 Flowise: Credential Data Leak CWE-200 - - 2026-06-08
CVE-2026-46442 Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape CWE-94 - - 2026-06-08
CVE-2026-46441 Flowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment CWE-284 - - 2026-06-08
CVE-2026-46440 Flowise: Basic Auth Credentials Exposed via API CWE-522 - - 2026-06-08
CVE-2026-42863 Flowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment CWE-284 - - 2026-06-08
CVE-2026-42862 Flowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment CWE-284 - - 2026-06-08
CVE-2026-42861 Flowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignment CWE-284 - - 2026-06-08
CVE-2026-46444 Flowise: Vector Store No Permission Checks CWE-862 - - 2026-06-08
CVE-2026-43995 Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) CWE-918 - - 2026-05-11
CVE-2026-8028 FlowiseAI Flowise Endpoint account.service.ts verify information disclosure CWE-200 3.7 Low 2026-05-06
CVE-2026-8027 FlowiseAI Flowise User Controller authorization CWE-639 4.3 Medium 2026-05-06
CVE-2026-8026 FlowiseAI Flowise API Response account.service.ts login information disclosure CWE-200 3.7 Low 2026-05-06
CVE-2026-41274 Flowise: Cypher Injection in GraphCypherQAChain CWE-943 9.8AI Critical AI 2026-04-23
CVE-2026-41264 Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability CWE-184 9.8AI Critical AI 2026-04-23
CVE-2026-41265 Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability CWE-77 9.6AI Critical AI 2026-04-23
CVE-2026-41279 Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials CWE-639 8.2AI High AI 2026-04-23
CVE-2026-41278 Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs CWE-200 7.5AI High AI 2026-04-23
CVE-2026-41276 Flowise: AccountService resetPassword Authentication Bypass Vulnerability CWE-287 7.4AI High AI 2026-04-23
CVE-2026-41277 Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR) CWE-284 8.8AI High AI 2026-04-23
CVE-2026-41275 Flowise: Password Reset Link Sent Over Unsecured HTTP CWE-319 6.8AI Medium AI 2026-04-23
CVE-2026-41273 Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow CWE-306 7.5AI High AI 2026-04-23
CVE-2026-41271 Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains CWE-918 8.6AI High AI 2026-04-23
CVE-2026-41272 Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) CWE-918 7.1 High 2026-04-23
CVE-2026-41270 Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox CWE-284 7.1 High 2026-04-23
CVE-2026-41269 Flowise: File Upload Validation Bypass in createAttachment CWE-434 7.1 High 2026-04-23
CVE-2026-41268 Flowise: Flowise Parameter Override Bypass Remote Command Execution CWE-20 9.8AI Critical AI 2026-04-23
CVE-2026-41267 Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association CWE-639 8.1 High 2026-04-23
CVE-2026-41266 Flowise: Sensitive Data Leak in public-chatbotConfig CWE-200 9.1AI Critical AI 2026-04-23
CVE-2026-41137 Flowise: Code Injection in CSVAgent leads to Authenticated RCE CWE-94 8.8AI High AI 2026-04-23
CVE-2026-41138 Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas. CWE-94 9.8AI Critical AI 2026-04-23

All 144 known CVE vulnerabilities affecting Flowise with full Chinese analysis, references, and POCs where available.