Flowise vulnerabilities

Newest CVEs

• CVE-2026-56271

  Flowise - Weak Default JWT Secrets in Authentication Middleware

  Flowise · Flowise

  Critical9.3
• CVE-2026-56273

  Flowise - Path Traversal in Vector Store basePath Parameter

  Flowise · Flowise

  Medium4.9
• CVE-2026-56278

  Flowise - Session Hijacking via Weak Default Express Session Secret

  Flowise · Flowise

  Critical9.3
• CVE-2026-56277

  Flowise - Hardcoded CORS Wildcard in TTS Endpoint

  Flowise · Flowise

  Medium6.9
• CVE-2026-58057

  Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity

  Flowise · Flowise

  Low2.3
• CVE-2025-71338

  Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API

  Flowise · Flowise

  Critical10.0
• CVE-2025-71336

  Flowise - Unsandboxed Remote Code Execution via Custom MCP

  Flowise · Flowise

  Critical9.3
• CVE-2025-71335

  Flowise - Session Invalidation Failure After Password Change

  Flowise · Flowise

  High8.6
• CVE-2025-71334

  Flowise - Arbitrary File Access via Missing Chat Flow ID Validation

  Flowise · Flowise

  Critical9.3
• CVE-2025-71333

  Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint

  Flowise · Flowise

  Critical9.3