Flowise Flowise vulnerabilities

• flowise Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity CVE-2026-58057 Public exploit 2.3 LowJune 28, 2026
• flowise Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint CVE-2026-56268 Fix available 5.3 MediumMay 20, 2026
• flowise Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override CVE-2026-56276 Fix available 6.0 MediumMay 20, 2026
• flowise Flowise - Hardcoded CORS Wildcard in TTS Endpoint CVE-2026-56277 Fix available 6.9 MediumMay 20, 2026
• flowise, flowise components +1 more Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess CVE-2026-56274 Public exploitFix available 8.7 HighMay 14, 2026
• flowise Flowise - Server-Side Request Forgery via Execute Flow Base URL CVE-2026-56275 Fix available 6.0 MediumApril 16, 2026
• flowise Flowise - Path Traversal in Vector Store basePath Parameter CVE-2026-56273 Fix available 4.9 MediumApril 16, 2026
• flowise Flowise - Weak Default Token Hash Secret in JWT Token Encryption CVE-2026-56269 Fix available 4.3 MediumApril 16, 2026
• flowise Flowise - Session Hijacking via Weak Default Express Session Secret CVE-2026-56278 Fix available 9.3 CriticalApril 16, 2026
• flowise Flowise - Weak Default JWT Secrets in Authentication Middleware CVE-2026-56271 Fix available 9.3 CriticalApril 16, 2026
• flowise Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint CVE-2026-56270 Fix available 8.7 HighApril 16, 2026
• flowise Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint CVE-2026-56267 Fix available 6.9 MediumMarch 5, 2026
• flowise Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing CVE-2026-56272 Fix available 5.6 MediumMarch 5, 2026
• flowise Flowise - Authentication Bypass via Unprotected Registration Endpoint CVE-2025-71327 9.3 CriticalNovember 17, 2025
• flowise Flowise - Unverified Password Change via Account Settings CVE-2025-71328 Fix available 8.7 HighNovember 14, 2025
• flowise Flowise - Unverified Email Change via Account Profile Endpoint CVE-2025-71337 Fix available 8.7 HighNovember 14, 2025
• flowise Flowise - Session Invalidation Failure After Password Change CVE-2025-71335 Fix available 8.6 HighNovember 14, 2025
• flowise Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows CVE-2025-71331 Fix available 5.1 MediumOctober 3, 2025
• flowise Flowise - Unsandboxed Remote Code Execution via Custom MCP CVE-2025-71336 Fix available 9.3 CriticalSeptember 15, 2025
• flowise Flowise - Arbitrary File Access via Missing Chat Flow ID Validation CVE-2025-71334 Fix available 9.3 CriticalSeptember 15, 2025
• flowise Flowise - Arbitrary File Read via chatId Parameter CVE-2025-71324 Fix available 8.7 HighSeptember 15, 2025
• flowise Flowise - SQL Injection in importChatflows API via chatflow.id Parameter CVE-2025-71332 8.5 HighApril 7, 2025
• flowise Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API CVE-2025-71338 Public exploit 10.0 CriticalMarch 14, 2025
• flowise Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint CVE-2025-71333 9.3 CriticalMarch 13, 2025
• flowise Flowise - Remote Code Execution via overrideConfig Parameter CVE-2024-58351 Fix available 9.3 CriticalNovember 21, 2024