Flowiseai vulnerabilities
120 CVEs and advisories name Flowiseai as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-46479Flowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover
- CVE-2026-46478Flowise: DatasetRow create+update mass-assignment allows cross-workspace row takeover
- CVE-2026-46477Flowise: Dataset create+update mass-assignment allows cross-workspace dataset takeover
- CVE-2026-46476Flowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeover
- CVE-2026-46475Flowise: Assistant create+update mass-assignment allows cross-workspace assistant takeover
- CVE-2026-46443Flowise: Credential Data Leak
- CVE-2026-46442Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
- CVE-2026-46441Flowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment
- CVE-2026-46440Flowise: Basic Auth Credentials Exposed via API
- CVE-2026-42863Flowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment
- CVE-2026-42862Flowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment
- CVE-2026-42861Flowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignment
- CVE-2026-46444Flowise: Vector Store No Permission Checks
- CVE-2026-43995Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
- CVE-2026-8028FlowiseAI Flowise Endpoint account.service.ts verify information disclosure
- CVE-2026-8027FlowiseAI Flowise User Controller authorization
- CVE-2026-8026FlowiseAI Flowise API Response account.service.ts login information disclosure
- CVE-2026-41274Flowise: Cypher Injection in GraphCypherQAChain
- CVE-2026-41264Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
- CVE-2026-41265Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
- CVE-2026-41279Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials
- CVE-2026-41278Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs
- CVE-2026-41276Flowise: AccountService resetPassword Authentication Bypass Vulnerability
- CVE-2026-41277Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)
- CVE-2026-41275Flowise: Password Reset Link Sent Over Unsecured HTTP
- CVE-2026-41273Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow
- CVE-2026-41271Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
- CVE-2026-41272Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
- CVE-2026-41270Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
- CVE-2026-41269Flowise: File Upload Validation Bypass in createAttachment