What is the CVSS score of CVE-2026-30822?

CVE-2026-30822 has a CVSS 3.0 base score of 7.7 (High). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-30822?

Yes, a public proof-of-concept exploit is available for CVE-2026-30822. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-30822?

Within 24 hours: Identify all Flowise deployments and their versions; isolate any running 3.0.13 or earlier from untrusted networks if possible. Within 7 days: Implement network segmentation or WAF rules to restrict access to Flowise administrative interfaces; monitor logs for suspicious object modification patterns. Within 30 days: Evaluate upgrade feasibility to versions beyond 3.0.13 once patches are released; if upgrade is not immediately possible, maintain strict access controls and consider running Flowise in a segregated environment with minimal privilege.

Flowise CVE-2026-30822

HIGH

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-03-07 security-advisories@github.com

GHSA-mq4r-h2gh-qv7x

Code Injection AI / ML Flowise Flowiseai

7.7

CVSS 3.0 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Access Flowise lead creation endpoint
Delivery

Craft malicious payload with database field injection
Exploit

Submit request with injected values
Execution

Corrupt internal database fields
Impact

Gain unauthorized data access

Vulnerability Assessment

Weakness	CWE CWE-915 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V4 - API and Web Service Object attribute protection
Exploitation Conditions	Flowise versions prior to 3.0.13 with unauthenticated lead creation endpoint exposed. Requires knowledge of internal database field names and access to the lead creation API without authentication.
Impact	CVSS 7.7 (HIGH). Attack vector: Network. Complexity: High. Privileges required: None. User interaction: None. Exploitation no authentication required. Public exploit/POC available.
Exploit ScenarioDerived	An attacker without authentication could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Flowise versions up to 3.0.13 is affected by improperly controlled modification of dynamically-determined object attributes (CVSS 7.7).

RemediationAI

Fixed in version 3.0.13.. Restrict network access to the affected service where possible.

Affected Packages

npm flowise fix: 3.0.13

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes) affects Flowise. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13.

Know when Flowise gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.7 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 11, 2026 - 13:40 vuln.today

Public exploit code

CVE Published

Mar 07, 2026 - 05:16 nvd

HIGH 7.7

DescriptionGitHub Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13.

Executive ViewAI

Why It Matters

Flowise versions 3.0.13 and earlier contain a vulnerability allowing attackers to modify object attributes without proper authorization, potentially leading to unauthorized data manipulation or system compromise. Organizations running affected versions face immediate risk, particularly if Flowise instances are internet-facing or process sensitive data.

Business Impact: High

Compensating Controls

Implement Web Application Firewall (WAF) rules to detect and block requests attempting object attribute modification; restrict network access to Flowise instances using firewall rules and VPN-only access; disable dynamic object attribute modification features if available in configuration; enforce strong authentication and multi-factor authentication for all administrative access; increase logging and monitoring for suspicious API calls and attribute changes; run Flowise with minimal required privileges and in isolated network segments away from production systems.

Threat Intelligence Overview

EPSS Score

0.1%

Top 72% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.