{"schema_version":1,"title":"FlowiseAI vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 23 vulnerabilities in FlowiseAI: 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-46476, was published on 8 June 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/flowiseai","json_url":"https://junglewise.ai/threats/vendors/flowiseai.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/flowiseai","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":13,"all_time":23,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":23},"latest":[{"cve":"CVE-2026-46476","cvss":4,"epss":0.0056,"slug":"cve-2026-46476-flowise-mass-assignment-in-customtemplate-allows-cross-workspace","title":"Flowise mass assignment in CustomTemplate allows cross-workspace takeover","severity":"high","exploited":false,"published_at":"2026-06-08T16:16:41.95+00:00","url":"https://junglewise.ai/threats/cve-2026-46476-flowise-mass-assignment-in-customtemplate-allows-cross-workspace"},{"cve":"CVE-2026-46441","cvss":4,"epss":0.0037,"slug":"cve-2026-46441-flowiseai-mass-assignment-in-assistant-update-endpoint","title":"FlowiseAI mass assignment in assistant update endpoint","severity":"high","exploited":false,"published_at":"2026-06-08T16:16:41.19+00:00","url":"https://junglewise.ai/threats/cve-2026-46441-flowiseai-mass-assignment-in-assistant-update-endpoint"},{"cve":"CVE-2026-46440","cvss":7.5,"epss":0.0042,"slug":"cve-2026-46440-flowiseai-flowise-insufficient-credential-protection-in","title":"FlowiseAI Flowise insufficient credential protection in checkBasicAuth","severity":"high","exploited":false,"published_at":"2026-06-08T16:16:41.043+00:00","url":"https://junglewise.ai/threats/cve-2026-46440-flowiseai-flowise-insufficient-credential-protection-in"},{"cvss":5.3,"slug":"flowise-cross-workspace-chatflow-disclosure-in-chatflows-apikey-a20eceb8","title":"Flowise cross-workspace chatflow disclosure in chatflows/apikey endpoint","severity":"medium","exploited":false,"published_at":"2026-05-20T15:45:19+00:00","url":"https://junglewise.ai/threats/flowise-cross-workspace-chatflow-disclosure-in-chatflows-apikey-a20eceb8"},{"cvss":6,"slug":"flowise-mass-assignment-in-put-api-v1-user-password-update-4e37338f","title":"Flowise mass assignment in PUT /api/v1/user password update","severity":"medium","exploited":false,"published_at":"2026-05-20T15:44:40+00:00","url":"https://junglewise.ai/threats/flowise-mass-assignment-in-put-api-v1-user-password-update-4e37338f"},{"cvss":6.9,"slug":"flowise-permissive-cors-policy-in-text-to-speech-endpoint-0f1fcd53","title":"Flowise permissive CORS policy in Text-to-Speech endpoint","severity":"medium","exploited":false,"published_at":"2026-05-20T15:38:02+00:00","url":"https://junglewise.ai/threats/flowise-permissive-cors-policy-in-text-to-speech-endpoint-0f1fcd53"},{"cvss":7.7,"slug":"flowiseai-mass-assignment-in-evaluator-component-5c27a24a","title":"FlowiseAI mass assignment in Evaluator component","severity":"high","exploited":false,"published_at":"2026-05-14T16:19:52+00:00","url":"https://junglewise.ai/threats/flowiseai-mass-assignment-in-evaluator-component-5c27a24a"},{"cvss":7.7,"slug":"flowiseai-mass-assignment-in-evaluation-service-75ff0b1f","title":"FlowiseAI mass assignment in Evaluation service","severity":"high","exploited":false,"published_at":"2026-05-14T16:19:49+00:00","url":"https://junglewise.ai/threats/flowiseai-mass-assignment-in-evaluation-service-75ff0b1f"},{"cvss":7.7,"slug":"flowiseai-mass-assignment-in-dataset-service-allows-cross-workspace-c4c369b5","title":"FlowiseAI mass assignment in dataset service allows cross-workspace takeover","severity":"high","exploited":false,"published_at":"2026-05-14T16:19:39+00:00","url":"https://junglewise.ai/threats/flowiseai-mass-assignment-in-dataset-service-allows-cross-workspace-c4c369b5"},{"cvss":7.7,"slug":"flowiseai-mass-assignment-in-customtemplate-service-77304a08","title":"FlowiseAI mass assignment in CustomTemplate service","severity":"high","exploited":false,"published_at":"2026-05-14T16:19:32+00:00","url":"https://junglewise.ai/threats/flowiseai-mass-assignment-in-customtemplate-service-77304a08"},{"cvss":7.7,"slug":"flowiseai-mass-assignment-in-assistant-create-and-update-ddc53d63","title":"FlowiseAI mass assignment in Assistant create and update","severity":"high","exploited":false,"published_at":"2026-05-14T16:19:28+00:00","url":"https://junglewise.ai/threats/flowiseai-mass-assignment-in-assistant-create-and-update-ddc53d63"},{"cvss":8.7,"slug":"flowiseai-missing-authorization-in-openai-assistants-vector-store-ae527476","title":"FlowiseAI missing authorization in OpenAI Assistants Vector Store","severity":"high","exploited":false,"published_at":"2026-05-14T16:19:23+00:00","url":"https://junglewise.ai/threats/flowiseai-missing-authorization-in-openai-assistants-vector-store-ae527476"},{"cvss":7,"slug":"flowiseai-sensitive-information-disclosure-in-credentials-service-ca26f155","title":"FlowiseAI sensitive information disclosure in credentials service","severity":"high","exploited":false,"published_at":"2026-05-14T14:58:12+00:00","url":"https://junglewise.ai/threats/flowiseai-sensitive-information-disclosure-in-credentials-service-ca26f155"},{"cvss":9.9,"slug":"flowiseai-authenticated-rce-via-nodevm-sandbox-escape-in-custom-186b4a99","title":"FlowiseAI authenticated RCE via NodeVM sandbox escape in custom function","severity":"critical","exploited":false,"published_at":"2026-05-14T14:57:53+00:00","url":"https://junglewise.ai/threats/flowiseai-authenticated-rce-via-nodevm-sandbox-escape-in-custom-186b4a99"},{"cvss":7.6,"slug":"flowiseai-mass-assignment-in-assistant-update-endpoint-ab48bc73","title":"FlowiseAI mass assignment in assistant update endpoint","severity":"high","exploited":false,"published_at":"2026-05-14T14:57:46+00:00","url":"https://junglewise.ai/threats/flowiseai-mass-assignment-in-assistant-update-endpoint-ab48bc73"},{"cvss":8.8,"slug":"flowise-mcp-security-bypass-leading-to-rce-974e8711","title":"Flowise MCP security bypass leading to RCE","severity":"high","exploited":false,"published_at":"2026-05-14T14:57:30+00:00","url":"https://junglewise.ai/threats/flowise-mcp-security-bypass-leading-to-rce-974e8711"},{"cvss":7.5,"slug":"flowiseai-insufficient-credential-protection-in-basic-auth-endpoint-ca392b86","title":"FlowiseAI insufficient credential protection in basic auth endpoint","severity":"high","exploited":false,"published_at":"2026-05-14T14:54:46+00:00","url":"https://junglewise.ai/threats/flowiseai-insufficient-credential-protection-in-basic-auth-endpoint-ca392b86"},{"cvss":6,"slug":"flowise-execute-flow-ssrf-in-base-url-field-469ec836","title":"Flowise Execute Flow SSRF in base url field","severity":"medium","exploited":false,"published_at":"2026-04-16T21:23:17+00:00","url":"https://junglewise.ai/threats/flowise-execute-flow-ssrf-in-base-url-field-469ec836"},{"cvss":4.9,"slug":"flowise-path-traversal-in-vector-store-basepath-a0c72c59","title":"Flowise path traversal in vector store basePath","severity":"medium","exploited":false,"published_at":"2026-04-16T21:22:49+00:00","url":"https://junglewise.ai/threats/flowise-path-traversal-in-vector-store-basepath-a0c72c59"},{"cvss":5.6,"slug":"flowise-hard-coded-default-secret-in-token-encryption-eb87cf55","title":"Flowise hard-coded default secret in token encryption","severity":"medium","exploited":false,"published_at":"2026-04-16T21:22:36+00:00","url":"https://junglewise.ai/threats/flowise-hard-coded-default-secret-in-token-encryption-eb87cf55"},{"cvss":5.6,"slug":"flowise-weak-default-session-secret-in-express-middleware-242a42fb","title":"Flowise weak default session secret in Express middleware","severity":"medium","exploited":false,"published_at":"2026-04-16T21:22:00+00:00","url":"https://junglewise.ai/threats/flowise-weak-default-session-secret-in-express-middleware-242a42fb"},{"cvss":5.6,"slug":"flowiseai-flowise-weak-default-jwt-secrets-in-passport-middleware-383c3858","title":"FlowiseAI Flowise weak default JWT secrets in passport middleware","severity":"medium","exploited":false,"published_at":"2026-04-16T21:21:12+00:00","url":"https://junglewise.ai/threats/flowiseai-flowise-weak-default-jwt-secrets-in-passport-middleware-383c3858"},{"cvss":5.3,"slug":"flowise-unauthenticated-oauth-secret-disclosure-in-loginmethod-api-4e74793a","title":"Flowise unauthenticated OAuth secret disclosure in loginmethod API","severity":"medium","exploited":false,"published_at":"2026-04-16T21:20:05+00:00","url":"https://junglewise.ai/threats/flowise-unauthenticated-oauth-secret-disclosure-in-loginmethod-api-4e74793a"}],"vendor":{"hub":true,"name":"FlowiseAI","slug":"flowiseai","homepage":"https://flowiseai.com","description":"FlowiseAI is a no-code platform for building conversational AI applications with customizable workflows.","url":"https://junglewise.ai/threats/vendors/flowiseai"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cvss":9.9,"slug":"flowiseai-authenticated-rce-via-nodevm-sandbox-escape-in-custom-186b4a99","title":"FlowiseAI authenticated RCE via NodeVM sandbox escape in custom function","severity":"critical","exploited":false,"published_at":"2026-05-14T14:57:53+00:00","url":"https://junglewise.ai/threats/flowiseai-authenticated-rce-via-nodevm-sandbox-escape-in-custom-186b4a99"},{"cvss":8.8,"slug":"flowise-mcp-security-bypass-leading-to-rce-974e8711","title":"Flowise MCP security bypass leading to RCE","severity":"high","exploited":false,"published_at":"2026-05-14T14:57:30+00:00","url":"https://junglewise.ai/threats/flowise-mcp-security-bypass-leading-to-rce-974e8711"},{"cvss":8.7,"slug":"flowiseai-missing-authorization-in-openai-assistants-vector-store-ae527476","title":"FlowiseAI missing authorization in OpenAI Assistants Vector Store","severity":"high","exploited":false,"published_at":"2026-05-14T16:19:23+00:00","url":"https://junglewise.ai/threats/flowiseai-missing-authorization-in-openai-assistants-vector-store-ae527476"},{"cvss":7.7,"slug":"flowiseai-mass-assignment-in-evaluator-component-5c27a24a","title":"FlowiseAI mass assignment in Evaluator component","severity":"high","exploited":false,"published_at":"2026-05-14T16:19:52+00:00","url":"https://junglewise.ai/threats/flowiseai-mass-assignment-in-evaluator-component-5c27a24a"},{"cvss":7.7,"slug":"flowiseai-mass-assignment-in-evaluation-service-75ff0b1f","title":"FlowiseAI mass assignment in Evaluation service","severity":"high","exploited":false,"published_at":"2026-05-14T16:19:49+00:00","url":"https://junglewise.ai/threats/flowiseai-mass-assignment-in-evaluation-service-75ff0b1f"},{"cvss":7.7,"slug":"flowiseai-mass-assignment-in-dataset-service-allows-cross-workspace-c4c369b5","title":"FlowiseAI mass assignment in dataset service allows cross-workspace takeover","severity":"high","exploited":false,"published_at":"2026-05-14T16:19:39+00:00","url":"https://junglewise.ai/threats/flowiseai-mass-assignment-in-dataset-service-allows-cross-workspace-c4c369b5"},{"cvss":7.7,"slug":"flowiseai-mass-assignment-in-customtemplate-service-77304a08","title":"FlowiseAI mass assignment in CustomTemplate service","severity":"high","exploited":false,"published_at":"2026-05-14T16:19:32+00:00","url":"https://junglewise.ai/threats/flowiseai-mass-assignment-in-customtemplate-service-77304a08"},{"cvss":7.7,"slug":"flowiseai-mass-assignment-in-assistant-create-and-update-ddc53d63","title":"FlowiseAI mass assignment in Assistant create and update","severity":"high","exploited":false,"published_at":"2026-05-14T16:19:28+00:00","url":"https://junglewise.ai/threats/flowiseai-mass-assignment-in-assistant-create-and-update-ddc53d63"},{"cvss":7.6,"slug":"flowiseai-mass-assignment-in-assistant-update-endpoint-ab48bc73","title":"FlowiseAI mass assignment in assistant update endpoint","severity":"high","exploited":false,"published_at":"2026-05-14T14:57:46+00:00","url":"https://junglewise.ai/threats/flowiseai-mass-assignment-in-assistant-update-endpoint-ab48bc73"},{"cve":"CVE-2026-46440","cvss":7.5,"epss":0.0042,"slug":"cve-2026-46440-flowiseai-flowise-insufficient-credential-protection-in","title":"FlowiseAI Flowise insufficient credential protection in checkBasicAuth","severity":"high","exploited":false,"published_at":"2026-06-08T16:16:41.043+00:00","url":"https://junglewise.ai/threats/cve-2026-46440-flowiseai-flowise-insufficient-credential-protection-in"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[{"name":"FlowiseAI","slug":"flowiseai","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/flowiseai"}]}