Skip to content
OpenAdvisories
High WID-SEC-2026-3102 10 CVEs

Flowise: Mehrere Schwachstellen

Published Aug 31, 2026 · Updated Sep 15, 2026 · Revision 2 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um erweiterte Berechtigungen – einschließlich Administratorzugriff – zu erlangen, um beliebigen Code auszuführen, SQL-Injection durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

Flowise ist eine Benutzeroberfläche zur Erstellung von LLMs (Large Language Model).

Vulnerabilities 10

  • High 8.8
    CVE-2026-91934

    Flowise before 3.1.4 Remote Code Execution via SQL Database Chain

    Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or in…

    FlowiseAI Flowise
  • High 8.5
    CVE-2026-91931

    Flowise before 3.1.4 Remote Code Execution via Custom MCP npx

    Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-co…

    FlowiseAI Flowise
  • High 8.5
    CVE-2026-91932

    Flowise before 3.1.4 Remote Code Execution via cwd Parameter

    Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args arr…

    FlowiseAI Flowise
  • High 8.3
    CVE-2026-91935

    Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes

    Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redire…

    FlowiseAI Flowise
  • High 7.5
    CVE-2026-91930

    Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover

    Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and ga…

    FlowiseAI Flowise
  • High 7.5
    CVE-2026-91937

    Flowise before 3.1.4 NoSQL Injection via sessionId

    Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history recor…

    FlowiseAI Flowise
  • High 7.1
    CVE-2026-91929

    Flowise before 3.1.4 Cross-Tenant Authorization Bypass

    Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organization…

    FlowiseAI Flowise
  • High 7.1
    CVE-2026-91933

    Flowise before 3.1.4 Authorization Bypass via openai-realtime

    Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFlows in other workspaces by supplying an unscoped chatflowid. Attackers can invoke GET and POST req…

    FlowiseAI Flowise
  • High 7.1
    CVE-2026-91938

    Flowise before 3.1.4 Server-Side Request Forgery via document loaders

    Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and pri…

    FlowiseAI Flowise
  • Medium 6.8
    CVE-2026-91936

    Flowise before 3.1.4 Script Injection via Docker Workflows

    Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters throu…

    FlowiseAI Flowise

Revision history

  1. #2

    Referenzen ergänzt

  2. #1

    Initiale Fassung

References