References https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p https://www.sonicwall.com/blog/flowiseai-custom-mcp-node-remote-code-execution- https://thehackernews.com/2026/04/flowise-ai-agent-builder-under-active.html https://securityaffairs.com/190471/security/attackers-exploit-critical-flowise-flaw-cve-2025-59528-for-remote-code-execution.html https://nvd.nist.gov/vuln/detail/CVE-2025-59528 https://cloud.tencent.com/developer/article/2630542 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7944-7c6r-55vv https://cve.imfht.com/detail/CVE-2026-41276 https://www.cnblogs.com/hetianlab/p/18796453 https://cn-sec.com/archives/4532500.html
Related VulnerabilitiesPoCflowise-chatflows-exposure: Flowise AI - Unauthenticated Chatflows API ExposureFlowise /api/v1/loginmethod 未授权访问漏洞(CVE-2026-56270)PoCCVE-2026-56270: Flowise <= 3.0.13 - Unauthenticated OAuth Configuration DisclosurePoCCVE-2025-71324: Flowise - Path TraversalPoCCVE-2026-69251: Flowise < 3.1.3 - Remote Code ExecutionFlowise /api/v1/chatflows 文件上传漏洞(CVE-2025-71334)PoCCVE-2025-71334: Flowise - Path TraversalPoCCVE-2026-46442: Flowise < 3.1.2 - node-custom-function Unauthorized RCEFlowiseAI Flowise /api/v1/node-custom-function 代码执行漏洞(CVE-2026-46442)PoCCVE-2024-36420: Flowise 1.4.3 - Arbitrary File ReadFlowise 任意文件读取漏洞(CVE-2024-36420)PoCCVE-2026-30824: Flowise - NVIDIA NIM Endpoints Missing AuthenticationPoCCVE-2025-59528: Flowise - Remote Code Execution