Flowise vendor intelligence

Flowise Known Exploited Vulnerabilities

Track evidence-backed exploitation affecting Flowise products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.

Browse Flowise KEVs Full KEV feed

Total KEVs: 8; Known exploited vulnerabilities affecting Flowise products
In CISA KEV: 0; Records also listed in the official catalog
Beyond CISA KEV: 8; Additional exploited CVEs absent from CISA KEV
Sensor Observed: 8; Flowise KEVs with sensor-observed exploitation activity

The catalog gap matters for Flowise exposure

Eight of the eight exploited Flowise CVEs tracked here are not in CISA KEV. Teams relying on the official catalog alone would miss 100% of this vendor portfolio.

0%
Covered by CISA: 100%
Beyond CISA: 1
Product families

Attested Flowise CVEs

Search the exploited-vulnerability portfolio, then narrow it to official CISA coverage or the additional records KEV Intelligence tracks beyond the catalog.

How exploitation is verified

CVE / description	Product	Confidence	CISA KEV	Added
CVE-2026-56270 Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint	Flowise	Confirmed	Beyond CISA	17 Aug 2026
CVE-2025-8943 Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers	Flowise	Confirmed	Beyond CISA	05 Aug 2026
CVE-2025-71324 Flowise - Arbitrary File Read via chatId Parameter	Flowise	Confirmed	Beyond CISA	03 Aug 2026
CVE-2025-71334 Flowise - Arbitrary File Access via Missing Chat Flow ID Validation	Flowise	Confirmed	Beyond CISA	28 Jul 2026
CVE-2024-36420 GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file	Flowise	Confirmed	Beyond CISA	17 Jul 2026
CVE-2026-46442 Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape	Flowise	Confirmed	Beyond CISA	17 Jul 2026
CVE-2024-8181 Flowise Authentication Bypass	Flowise	Confirmed	Beyond CISA	30 Jul 2025
CVE-2025-26319 FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.	Flowise	Confirmed	Beyond CISA	24 Jun 2025

Showing 8 of 8 Flowise known exploited vulnerabilities.

Recurring weakness patterns

External control, missing authentication for critical function, and unrestricted upload account for five mapped occurrences across this Flowise KEV portfolio.

Browse all KEVs →

CWE-73

External Control of File Name or Path

CWE-306

Missing Authentication for Critical Function

CWE-434

Unrestricted Upload of File with Dangerous Type

CWE-287

Improper Authentication

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-862

Missing Authorization

CWE-94

Improper Control of Generation of Code ('Code Injection')

Early warning alerts

Get alerts on high-impact exploitation

Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.