flowise has 5 CVEs on record between 2024 and 2026. 3 were published in the last 90 days. The busiest recent month was August 2026 with 3. The median CVSS is 8.2 (high), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.2
- Publish → KEV
- —
- Last 90 days
- 3 prev 1
Worst active — by depth score
GHSA-5w6g-rc45-wvv9Critical· 9.8Duplicate Advisory: Flowise OverrideConfig security vulnerability54CVE-2024-58351HighFlowise OverrideConfig security vulnerability41GHSA-rwrp-9823-p2xqMedium· 6.5Flowise: Incomplete Credential Redaction Exposes Secrets via API36GHSA-8gj2-2cvc-6xx7MediumFlowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials28GHSA-2364-jh4q-m9vmMediumFlowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint28
flowise vulnerabilities
CVEs affecting flowise, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
GHSA-8gj2-2cvc-6xx7MediumFlowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
GHSA-rwrp-9823-p2xqMedium· 6.5Flowise: Incomplete Credential Redaction Exposes Secrets via API
Flowise: Incomplete Credential Redaction Exposes Secrets via API
GHSA-2364-jh4q-m9vmMediumFlowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint
Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint
GHSA-5w6g-rc45-wvv9Critical· 9.8Duplicate Advisory: Flowise OverrideConfig security vulnerability
Duplicate Advisory: Flowise OverrideConfig security vulnerability
CVE-2024-58351HighFlowise OverrideConfig security vulnerability
Flowise OverrideConfig security vulnerability