Is there a public PoC exploit available for CVE-2026-8028?

Yes, a public proof-of-concept exploit is available for CVE-2026-8028. Prioritise patching immediately. EPSS: 0.0%.

FlowiseAI Flowise CVE-2026-8028

Q: What is the CVSS score of CVE-2026-8028?

CVE-2026-8028 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27832 LOW

Information Exposure (CWE-200)

2026-05-06 VulDB

Information Disclosure Flowise

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 06, 2026 - 15:22 NVD

3.7 (LOW) 2.9 (LOW)

Analysis Generated

May 06, 2026 - 15:01 vuln.today

DescriptionCVE.org

A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.service.ts of the component Endpoint. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit is now public and may be used. Upgrading the affected component is recommended.

AnalysisAI

FlowiseAI Flowise up to version 3.0.12 allows remote unauthenticated information disclosure through manipulation of the account verification endpoint. An attacker can exploit improper input validation in the verify function of the account service to extract sensitive information over the network. Publicly available exploit code exists, and the vendor has recommended upgrading to address this issue.

Technical ContextAI

The vulnerability resides in the verify function within packages/server/src/enterprise/services/account.service.ts, which handles endpoint authentication and validation logic. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the verification mechanism fails to properly protect confidential data during processing. The affected component is part of FlowiseAI's enterprise account management system, which is likely responsible for validating user credentials or session tokens. The vulnerability allows attackers to bypass or manipulate this verification process to gain unauthorized access to sensitive information.

RemediationAI

Immediately upgrade FlowiseAI Flowise to a version after 3.0.12. The vendor's official advisory (referenced via VulDB) recommends upgrading the affected component, though the specific target version is not detailed in the provided references. Administrators should check the FlowiseAI GitHub repository or official release notes for the next available version after 3.0.12. Until patching is possible, restrict network access to the Flowise endpoint using firewall rules or reverse proxy authentication to limit exposure to trusted networks only. Disable the account verification endpoint entirely if it is not required for current operations. Additionally, monitor access logs for suspicious requests to the verify endpoint and implement rate limiting on authentication endpoints to reduce exploitation attempts.