Flowise vulnerabilities
25 CVEs and advisories name Flowise as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-56271Flowise - Weak Default JWT Secrets in Authentication Middleware
- CVE-2026-56273Flowise - Path Traversal in Vector Store basePath Parameter
- CVE-2026-56278Flowise - Session Hijacking via Weak Default Express Session Secret
- CVE-2026-56277Flowise - Hardcoded CORS Wildcard in TTS Endpoint
- CVE-2026-58057Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity
- CVE-2025-71338Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API
- CVE-2025-71336Flowise - Unsandboxed Remote Code Execution via Custom MCP
- CVE-2025-71335Flowise - Session Invalidation Failure After Password Change
- CVE-2025-71334Flowise - Arbitrary File Access via Missing Chat Flow ID Validation
- CVE-2025-71333Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint
- CVE-2025-71328Flowise - Unverified Password Change via Account Settings
- CVE-2025-71327Flowise - Authentication Bypass via Unprotected Registration Endpoint
- CVE-2025-71324Flowise - Arbitrary File Read via chatId Parameter
- CVE-2026-56272Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing
- CVE-2026-56270Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint
- CVE-2026-56269Flowise - Weak Default Token Hash Secret in JWT Token Encryption
- CVE-2025-71332Flowise - SQL Injection in importChatflows API via chatflow.id Parameter
- CVE-2026-56275Flowise - Server-Side Request Forgery via Execute Flow Base URL
- CVE-2026-56274Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess
- CVE-2025-71337Flowise - Unverified Email Change via Account Profile Endpoint
- CVE-2026-56268Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint
- CVE-2026-56276Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override
- CVE-2026-56267Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint
- CVE-2025-71331Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows
- CVE-2024-58351Flowise - Remote Code Execution via overrideConfig Parameter