PatchTheCVEflowise vulnerabilities and fixes
Recent CVEs affecting flowise, with upgrade or downgrade steps. 36 tracked.
flowise has 36 tracked vulnerabilities, 9 critical. A fixed release or vendor patch exists for 36. Most recent: 2026-08-13. Highest priority: CVE-2026-73487 (score 63/100).
- CVE-2026-69253 HIGH 8.8 UPGRADE Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows
- CVE-2026-69254 HIGH 8.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-69250 HIGH 7.5 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-69252 HIGH 8.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-69264 CRITICAL 9.8 UPGRADE Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly
- CVE-2026-70470 CRITICAL 9.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-70477 CRITICAL 9.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-69263 CRITICAL 9.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-69258 CRITICAL 9.1 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-70478 CRITICAL 10.0 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-69256 HIGH 8.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-69259 HIGH 8.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-70476 HIGH 8.2 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-67622 CRITICAL 9.9 UPGRADE Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants inte
- CVE-2026-69257 HIGH 8.6 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-70636 HIGH 7.5 UPGRADE Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to
- CVE-2026-69255 HIGH 8.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-70472 HIGH 8.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-69262 HIGH 8.1 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-70473 HIGH 8.5 UPGRADE Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows
- CVE-2026-70474 HIGH 8.1 UPGRADE Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows
- CVE-2026-67621 HIGH 7.6 UPGRADE Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace membe
- CVE-2026-70475 MEDIUM 6.5 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
- CVE-2026-70471 MEDIUM 6.5 UPGRADE Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows
- CVE-2026-67620 HIGH 7.7 UPGRADE Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in ht
- CVE-2026-73483 HIGH 8.8 UPGRADE Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@fl
- CVE-2026-71962 HIGH 7.5 UPGRADE Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-
- CVE-2026-73484 HIGH 8.1 UPGRADE Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block nat
- CVE-2026-73487 CRITICAL 9.8 UPGRADE Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that
- CVE-2026-73602 CRITICAL 9.9 UPGRADE Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authent
- CVE-2026-73486 HIGH 8.8 UPGRADE Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter t
- CVE-2026-73485 HIGH 8.8 UPGRADE Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenti
- CVE-2026-73601 HIGH 8.8 UPGRADE Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM
- CVE-2026-73604 MEDIUM 6.5 UPGRADE Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/
- CVE-2026-73488 MEDIUM 6.5 UPGRADE Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/org
- CVE-2026-73603 MEDIUM 5.3 UPGRADE Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, all
FAQ
How do I fix flowise vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is flowise being exploited right now?
None of the tracked flowise CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which flowise CVE should I patch first?
CVE-2026-73487 currently ranks highest (63/100): Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that .