CVE-2026-52098: Flowise unauthenticated RCE

CISO Take

Flowise 3.1.2, a widely-used low-code platform for building LLM agents and RAG pipelines, contains a code injection flaw (CWE-94) in its /api/v1/prediction/<flowId> endpoint that lets a remote, unauthenticated attacker execute arbitrary code on the server. This is about as bad as it gets: CVSS 9.8, no privileges or user interaction required, network-reachable, and full compromise of confidentiality, integrity, and availability. Flowise instances are frequently self-hosted and internet-exposed to serve chatbot/agent endpoints to end users, and this vulnerability specifically targets the API key validation logic referenced in validateKey.ts, meaning the auth control developers assume is protecting this endpoint may be bypassable. There is no CISA KEV listing or public exploit yet, but given the trivial exploitability and criticality, treat this as a same-day patch item: update to the fixed Flowise release immediately, and in the meantime restrict network access to the prediction API (allowlist, VPN, or reverse-proxy auth) and audit outbound/process logs on Flowise hosts for anomalous child processes or reverse shells.

Sources: NVD GitHub (FlowiseAI/Flowise repository) ATLAS

What is the risk?

Critical, actionable risk. CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-exploitable, low-complexity, zero-authentication path to full code execution — the worst-case combination. While EPSS scoring is not yet available and no public PoC or Nuclei template has been observed, the vulnerability sits in a core, always-on API endpoint of a popular AI agent-building platform, which historically attracts fast scanning once details circulate (comparable Flowise/Langflow/Ollama RCEs have seen rapid weaponization). Exposure is high wherever Flowise is deployed with internet-facing prediction endpoints, which is common for production chatbot/agent use cases.

How does the attack unfold?

Reconnaissance

Attacker scans for internet-exposed Flowise instances and enumerates or guesses valid flowId values via the API or UI.

AML.T0006

Exploitation

Attacker sends a crafted unauthenticated request to /api/v1/prediction/<flowId> exploiting the CWE-94 code injection flaw.

AML.T0049

Code Execution

The malicious payload executes within the Flowise Node.js backend process, granting the attacker a remote shell on the host.

AML.T0050

Impact

Attacker harvests stored LLM/vector-store credentials, tampers with connected agent tools or RAG sources, and pivots for further compromise.

AML.T0112

Reconnaissance

Attacker scans for internet-exposed Flowise instances and enumerates or guesses valid flowId values via the API or UI.

AML.T0006

Exploitation

Attacker sends a crafted unauthenticated request to /api/v1/prediction/<flowId> exploiting the CWE-94 code injection flaw.

AML.T0049

Code Execution

The malicious payload executes within the Flowise Node.js backend process, granting the attacker a remote shell on the host.

AML.T0050

Impact

Attacker harvests stored LLM/vector-store credentials, tampers with connected agent tools or RAG sources, and pivots for further compromise.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 55% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Identify all Flowise deployments and confirm version — upgrade past 3.1.2 to the patched release as soon as it is available (check FlowiseAI/Flowise GitHub releases and advisories). 2) Until patched, do not expose the /api/v1/prediction/<flowId> endpoint directly to the internet — place it behind a reverse proxy requiring authentication, or restrict via IP allowlist/VPN. 3) Rotate any API keys or secrets stored in Flowise flow configurations, since the auth-bypass nature of this bug means keys may already be exposed. 4) Review validateKey.ts-based API key enforcement in your deployment and confirm it cannot be bypassed by crafted requests. 5) Monitor Flowise host process activity for unexpected child processes, outbound connections, or reverse shells, and check server/application logs for anomalous requests to the prediction endpoint. 6) If a Nuclei template or public PoC emerges, prioritize scanning your own perimeter for exposed instances.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0112 - Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-52098?

Flowise 3.1.2, a widely-used low-code platform for building LLM agents and RAG pipelines, contains a code injection flaw (CWE-94) in its /api/v1/prediction/<flowId> endpoint that lets a remote, unauthenticated attacker execute arbitrary code on the server. This is about as bad as it gets: CVSS 9.8, no privileges or user interaction required, network-reachable, and full compromise of confidentiality, integrity, and availability. Flowise instances are frequently self-hosted and internet-exposed to serve chatbot/agent endpoints to end users, and this vulnerability specifically targets the API key validation logic referenced in validateKey.ts, meaning the auth control developers assume is protecting this endpoint may be bypassable. There is no CISA KEV listing or public exploit yet, but given the trivial exploitability and criticality, treat this as a same-day patch item: update to the fixed Flowise release immediately, and in the meantime restrict network access to the prediction API (allowlist, VPN, or reverse-proxy auth) and audit outbound/process logs on Flowise hosts for anomalous child processes or reverse shells.

Is CVE-2026-52098 actively exploited?

No confirmed active exploitation of CVE-2026-52098 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-52098?

1) Identify all Flowise deployments and confirm version — upgrade past 3.1.2 to the patched release as soon as it is available (check FlowiseAI/Flowise GitHub releases and advisories). 2) Until patched, do not expose the /api/v1/prediction/<flowId> endpoint directly to the internet — place it behind a reverse proxy requiring authentication, or restrict via IP allowlist/VPN. 3) Rotate any API keys or secrets stored in Flowise flow configurations, since the auth-bypass nature of this bug means keys may already be exposed. 4) Review validateKey.ts-based API key enforcement in your deployment and confirm it cannot be bypassed by crafted requests. 5) Monitor Flowise host process activity for unexpected child processes, outbound connections, or reverse shells, and check server/application logs for anomalous requests to the prediction endpoint. 6) If a Nuclei template or public PoC emerges, prioritize scanning your own perimeter for exposed instances.

What systems are affected by CVE-2026-52098?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code/no-code AI orchestration platforms, RAG pipelines.

What is the CVSS score for CVE-2026-52098?

CVE-2026-52098 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.78%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code/no-code AI orchestration platformsRAG pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0112 Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint

Exploitation Scenario

An attacker scans the internet for exposed Flowise instances (default port 3000, or common reverse-proxy paths) and enumerates or guesses valid flowId values, which are often predictable or discoverable via the Flowise UI/API. The attacker crafts a POST request to /api/v1/prediction/<flowId> containing a payload that exploits the code injection weakness (CWE-94), bypassing the intended API key check. The malicious input is processed server-side and executed within the Node.js backend, giving the attacker a remote shell on the host. From there, they harvest LLM provider API keys and vector database credentials stored in the flow configuration, tamper with connected agent tools or RAG data sources, and use the compromised server as a launchpad for further lateral movement or to poison downstream AI outputs served to end users.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.