[ Vendor · 8 CVEs ]
FlowiseAI
CVEs affecting FlowiseAI published in the last 30 days, plus any FlowiseAI CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-100608 | 26 Sep 2026 | CVSS 8.3 | FlowiseAI FlowiseFlowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and… | |
| CVE-2026-100609 | 26 Sep 2026 | CVSS 6.8 | FlowiseAI FlowiseFlowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's… | |
| CVE-2026-100610 | 26 Sep 2026 | CVSS 7.5 | FlowiseAI FlowiseFlowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing… | |
| CVE-2026-100605 | 26 Sep 2026 | CVSS 7.1 | FlowiseAI FlowiseFlowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat… | |
| CVE-2026-100606 | 26 Sep 2026 | CVSS 7.7 | FlowiseAI FlowiseFlowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback… | |
| CVE-2026-100607 | 26 Sep 2026 | CVSS 7.7 | FlowiseAI FlowiseFlowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing… | |
| CVE-2026-73487 | 13 Aug 2026 | CVSS 9.0 | Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator BypassFlowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to… | Fix |
| CVE-2026-73483 | 13 Aug 2026 | CVSS 9.4 | Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via ChromiumFlowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An… | Fix |