DeutschShown in its original language — a full translation is planned for a future version.
Flowise: Mehrere Schwachstellen ermöglichen Codeausführung
view advisory published 2026-05-14
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um Code auszuführen, Objekte anderer Benutzer zu übernehmen, Informationen offenzulegen und weitere, nicht näher genannte Auswirkungen zu erzielen.
01
describes (17)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-56277US | medium6.5 | — | ||
Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation endpoint (packages/server/src/controllers/text-to-speech/in… | ||||
| CVE-2026-56274US | — | Exploit | ||
Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local f… | ||||
| CVE-2026-56268US | —OT elevated | — | ||
Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omitted (the default), t… | ||||
| CVE-2026-46480US | high8.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluator create and update mass-assignment allows cross-workspace… | ||||
| CVE-2026-46479US | high8.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluation create and update mass-assignment allows cross-workspace… | ||||
| CVE-2026-46478US | high8.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, DatasetRow create and update mass-assignment allows cross-workspace… | ||||
| CVE-2026-46477US | high8.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, dataset create and update mass-assignment allows cross-workspace da… | ||||
| CVE-2026-46476US | high8.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, CustomTemplate create and update mass-assignment allows cross-works… | ||||
| CVE-2026-46475US | high8.8 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, assistant create and update mass-assignment allows cross-workspace… | ||||
| CVE-2026-46444US | high8.8OT elevated | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, all CRUD endpoints for OpenAI Assistants Vector Store have no authe… | ||||
| CVE-2026-46443US | medium6.5 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, when credentials are fetched with a credentialName filter parameter… | ||||
| CVE-2026-46442US | critical9.9 | Exploit | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization,… | ||||
| CVE-2026-46441US | critical9.6 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the assistant update endp… | ||||
| CVE-2026-46440US | critical9.1 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext with… | ||||
| CVE-2026-42863US | high8.1 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the chatflow update endpo… | ||||
| CVE-2026-42862US | medium5.0 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the tool update endpoint… | ||||
| CVE-2026-42861US | critical9.6 | — | ||
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpo… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-59fh-9f3p-7m39 vom 2026-05-14external
- GitHub Security Advisory GHSA-5h9v-837x-m97r vom 2026-05-14external
- GitHub Security Advisory GHSA-5wxp-qjgq-fx6m vom 2026-05-14external
- GitHub Security Advisory GHSA-6fw7-3q8r-m5vj vom 2026-05-14external
- GitHub Security Advisory GHSA-728h-4mwj-f2p4 vom 2026-05-14external
- GitHub Security Advisory GHSA-78pr-c5x5-jggc vom 2026-05-14external
- GitHub Security Advisory GHSA-7g73-99r4-m4mj vom 2026-05-14external
- GitHub Security Advisory GHSA-7j65-65cr-6644 vom 2026-05-14external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan