Flowise vendor intelligence
Flowise Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting Flowise products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.
- Total KEVs
- 11
- Known exploited vulnerabilities affecting Flowise products
- In CISA KEV
- 0
- Records also listed in the official catalog
- Beyond CISA KEV
- 11
- Additional exploited vulnerabilities absent from CISA KEV
- Sensor Observed
- 9
- Flowise KEVs with sensor-observed exploitation activity
The catalog gap matters for Flowise exposure
All eleven exploited Flowise vulnerabilities tracked by Previdian are not in CISA KEV. Teams relying on the official catalog alone would miss 100% of this vendor portfolio.
- 0%
- Covered by CISA
- 100%
- Beyond CISA
- 1
- Product families
Attested Flowise vulnerabilities
11 known exploited vulnerabilities in this exploited-vulnerability portfolio. Search, then narrow it to official CISA coverage or the additional records Previdian tracks beyond the catalog.
How exploitation is verified| CVE / description | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2026-56271
Flowise - Weak Default JWT Secrets in Authentication Middleware |
Flowise | High | Beyond CISA | 22 Sep 2026 |
|
CVE-2026-69255
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified |
Flowise | Confirmed | Beyond CISA | 15 Sep 2026 |
|
CVE-2026-56270
Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint |
Flowise | Confirmed | Beyond CISA | 17 Aug 2026 |
|
CVE-2025-8943
Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers |
Flowise | Confirmed | Beyond CISA | 05 Aug 2026 |
|
CVE-2025-71324
Flowise - Arbitrary File Read via chatId Parameter |
Flowise | Confirmed | Beyond CISA | 03 Aug 2026 |
|
CVE-2025-71334
Flowise - Arbitrary File Access via Missing Chat Flow ID Validation |
Flowise | Confirmed | Beyond CISA | 28 Jul 2026 |
|
CVE-2024-36420
GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file |
Flowise | Confirmed | Beyond CISA | 17 Jul 2026 |
|
CVE-2026-46442
Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape |
Flowise | Confirmed | Beyond CISA | 17 Jul 2026 |
|
CVE-2025-55346
Unintended dynamic code execution leads to remote code execution by network attackers |
Flowise | High | Beyond CISA | 01 Jun 2026 |
|
CVE-2024-8181
Flowise Authentication Bypass |
Flowise | Confirmed | Beyond CISA | 30 Jul 2025 |
|
CVE-2025-26319
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments. |
Flowise | Confirmed | Beyond CISA | 24 Jun 2025 |
No Flowise vulnerabilities match this search or filter.
Showing 11 of 11 on this page (11 Flowise known exploited vulnerabilities).
Recurring weakness patterns
Control, missing authentication for critical function, and external control account for seven mapped occurrences across this Flowise KEV portfolio.
CWE-94
Improper Control of Generation of Code ('Code Injection')
CWE-306
Missing Authentication for Critical Function
CWE-73
External Control of File Name or Path
CWE-434
Unrestricted Upload of File with Dangerous Type
CWE-287
Improper Authentication
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-862
Missing Authorization
CWE-321
Use of Hard-coded Cryptographic Key