CVE-2025-71327: Flowise auth bypass grants full

CISO Take

Flowise, a widely-deployed open-source AI agent builder, contains a critical authentication bypass that allows any unauthenticated attacker to POST to /api/v1/account/register and create a privileged account granting full API access. This is especially dangerous because Flowise instances typically store LLM API keys, database credentials, and tool configurations that adversaries can immediately harvest — and agent workflows can be silently modified to exfiltrate data or inject malicious behavior into production AI pipelines. The exploit requires a single unauthenticated HTTP POST with no specialized knowledge, placing weaponization timelines in hours rather than days despite no public exploit or CISA KEV listing yet; Flowise's history of 112 prior CVEs in the same package further signals persistent security debt in this component. No patched version is listed; immediately block the /api/v1/account/register endpoint at your WAF or reverse proxy, audit existing accounts for unauthorized registrations, and rotate all credentials stored in Flowise node configurations.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

Critical risk. CVSS 9.1 with a fully unauthenticated, network-accessible, zero-interaction exploit path (AV:N/AC:L/PR:N/UI:N) makes this a trivial, wide-blast vulnerability requiring no prior foothold. Flowise instances are commonly deployed in enterprise AI pipelines with privileged access to LLM APIs, databases, and external tooling — a single POST request translates directly into credential theft and persistent agent workflow compromise. Self-hosted instances may be internet-facing or laterally reachable across cloud environments. The absence of a patched version at disclosure time significantly extends the exposure window.

How does the attack unfold?

Reconnaissance

Attacker identifies internet-facing Flowise instance via Shodan scanning on default port 3000 or by searching public GitHub repositories for exposed Flowise deployment configurations.

AML.T0006

Initial Access

Attacker sends a single unauthenticated POST to /api/v1/account/register with arbitrary credentials, exploiting the missing authentication check to create a privileged Flowise account.

AML.T0049

Credential Harvesting

With a valid session, attacker enumerates all agent flow configurations and extracts embedded LLM API keys, database connection strings, and third-party tool secrets.

AML.T0083

Persistence & Impact

Attacker modifies production agent workflows to silently exfiltrate user queries and LLM outputs to an external endpoint, or uses harvested credentials to pivot to connected LLM providers, databases, and enterprise systems.

AML.T0053

Reconnaissance

Attacker identifies internet-facing Flowise instance via Shodan scanning on default port 3000 or by searching public GitHub repositories for exposed Flowise deployment configurations.

AML.T0006

Initial Access

Attacker sends a single unauthenticated POST to /api/v1/account/register with arbitrary credentials, exploiting the missing authentication check to create a privileged Flowise account.

AML.T0049

Credential Harvesting

With a valid session, attacker enumerates all agent flow configurations and extracts embedded LLM API keys, database connection strings, and third-party tool secrets.

AML.T0083

Persistence & Impact

Attacker modifies production agent workflows to silently exfiltrate user queries and LLM outputs to an external endpoint, or uses harvested credentials to pivot to connected LLM providers, databases, and enterprise systems.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

9.1 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A None

What should I do?

7 steps

Immediately add a WAF or reverse proxy deny rule for POST /api/v1/account/register to block unauthenticated registration from any untrusted network segment.
Audit the Flowise user store (admin panel or direct DB query) for accounts not recognized — delete unauthorized entries and invalidate their sessions.
Rotate all credentials stored in Flowise agent configurations: LLM API keys, database passwords, webhook secrets, and third-party tool tokens.
Monitor GHSA-v5w9-prxf-w882 and the FlowiseAI/Flowise repository for a patched release; apply immediately on availability.
Restrict Flowise to internal networks only — remove any public internet exposure.
Review all agent workflow definitions for unauthorized modifications introduced during the exposure window.
Enable API-level audit logging on Flowise to detect anomalous account creation or workflow modification events going forward.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Privacy Violation Agent Framework AML.T0012 - Valid Accounts AML.T0021 - Establish Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15(5) - Cybersecurity for High-Risk AI Systems

ISO 42001

A.6.2 - AI System Access Control

NIST AI RMF

GOVERN-6.2 - Risk and Vulnerability Management

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2025-71327?

Flowise, a widely-deployed open-source AI agent builder, contains a critical authentication bypass that allows any unauthenticated attacker to POST to /api/v1/account/register and create a privileged account granting full API access. This is especially dangerous because Flowise instances typically store LLM API keys, database credentials, and tool configurations that adversaries can immediately harvest — and agent workflows can be silently modified to exfiltrate data or inject malicious behavior into production AI pipelines. The exploit requires a single unauthenticated HTTP POST with no specialized knowledge, placing weaponization timelines in hours rather than days despite no public exploit or CISA KEV listing yet; Flowise's history of 112 prior CVEs in the same package further signals persistent security debt in this component. No patched version is listed; immediately block the /api/v1/account/register endpoint at your WAF or reverse proxy, audit existing accounts for unauthorized registrations, and rotate all credentials stored in Flowise node configurations.

Is CVE-2025-71327 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71327, increasing the risk of exploitation.

How to fix CVE-2025-71327?

1. Immediately add a WAF or reverse proxy deny rule for POST /api/v1/account/register to block unauthenticated registration from any untrusted network segment. 2. Audit the Flowise user store (admin panel or direct DB query) for accounts not recognized — delete unauthorized entries and invalidate their sessions. 3. Rotate all credentials stored in Flowise agent configurations: LLM API keys, database passwords, webhook secrets, and third-party tool tokens. 4. Monitor GHSA-v5w9-prxf-w882 and the FlowiseAI/Flowise repository for a patched release; apply immediately on availability. 5. Restrict Flowise to internal networks only — remove any public internet exposure. 6. Review all agent workflow definitions for unauthorized modifications introduced during the exposure window. 7. Enable API-level audit logging on Flowise to detect anomalous account creation or workflow modification events going forward.

What systems are affected by CVE-2025-71327?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, LLM workflow orchestration, RAG pipelines, Tool-augmented AI systems, Enterprise AI automation platforms.

What is the CVSS score for CVE-2025-71327?

CVE-2025-71327 has a CVSS v3.1 base score of 9.1 (CRITICAL). The EPSS exploitation probability is 0.58%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksLLM workflow orchestrationRAG pipelinesTool-augmented AI systemsEnterprise AI automation platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0021 Establish Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15(5)

ISO 42001: A.6.2

NIST AI RMF: GOVERN-6.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

Exploitation Scenario

An attacker scans for internet-facing Flowise instances using Shodan queries on default port 3000 or by searching public GitHub repositories for Flowise deployment configurations. They send a single unauthenticated POST request to /api/v1/account/register with a crafted JSON body containing a chosen username and password — the endpoint accepts it and creates a valid privileged account. Using these credentials, the attacker authenticates and obtains a full API session token. They enumerate all configured agent flows, extracting LLM API keys (OpenAI, Anthropic), database connection strings, and webhook secrets embedded in node configurations. With persistent access, they modify a production RAG agent workflow to silently forward all user queries and LLM responses to an attacker-controlled webhook endpoint — the agent continues functioning normally while exfiltrating sensitive data in the background, with the compromise remaining undetected until the next manual audit.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function Primary CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.