Flowise CVE-2026-41267

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c

FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una

Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9

Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent

Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi

Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per

Privilege escalation in Flowise versions prior to 3.0.13 allows authenticated users to bypass API authorization by spoof

Flowise versions up to 3.0.13 is affected by authorization bypass through user-controlled key (CVSS 8.8).

Authenticated remote code execution in FlowiseAI Flowise (v3.0.1 up to but not including 3.0.8, and later versions when

An Authentication Bypass vulnerability exists in Flowise version 1.8.2. Rated high severity (CVSS 8.1), this vulnerabili

Flowise versions up to 3.0.13 is affected by improperly controlled modification of dynamically-determined object attribu