CVE-2026-52098 in Flowise
Summary
by MITRE • 09/10/2026
An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in Flowise version 3.1.2 represents a critical server-side security flaw that compromises the integrity of applications built upon this framework. Flowise is an open-source tool designed to facilitate the creation of chatbots and AI agents using Large Language Models, often integrating with various external data sources and APIs through its modular architecture. The specific weakness resides within the /api/v1/prediction/ endpoint, which serves as a primary interface for users to submit prompts or queries that trigger model inference processes. This endpoint is central to the application's functionality, handling user input and orchestrating the flow of information between the frontend client and backend AI services.
The technical nature of this vulnerability allows a remote attacker to execute arbitrary code on the host system running Flowise. This typically occurs due to insufficient sanitization or validation of inputs passed through the prediction endpoint. In many such scenarios, attackers can inject malicious payloads that exploit unsafe deserialization practices, command injection vulnerabilities within underlying libraries, or improper handling of dynamic function calls. By crafting a specially formatted request containing executable code disguised as legitimate data parameters, an attacker bypasses standard input filters and gains execution privileges at the level of the application server. This capability transforms what should be a simple text-processing service into a vector for full system compromise.
The operational impact of this vulnerability is severe, extending far beyond mere unauthorized access to sensitive data. Successful exploitation enables complete control over the underlying operating environment. An attacker can install backdoors, exfiltrate confidential information processed by the AI models, or use the compromised server as a pivot point to attack other systems within the network infrastructure. Given that Flowise applications often connect to proprietary databases and internal APIs, this breach poses significant risks to intellectual property and organizational security posture. Furthermore, because LLM-based applications may process sensitive user inputs, the compromise also raises serious privacy concerns regarding data leakage and potential manipulation of AI outputs for malicious purposes such as phishing or misinformation campaigns.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and potentially CWE-502 Deserialization of Untrusted Data if the execution involves parsing serialized objects without adequate verification. In terms of offensive security frameworks, it maps to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter for executing system commands or T1190 Exploit Public-Facing Application when leveraging this endpoint remotely. These classifications highlight the direct path from initial access via a web service to full command execution on the target host.
Mitigation strategies must address both immediate remediation and long-term architectural resilience. The most effective solution is to upgrade Flowise to version 3.1.2 or later if a patch has been released, ensuring that all known vulnerabilities in the prediction endpoint are addressed by the developers. In cases where upgrading is not immediately feasible, organizations should implement strict input validation and sanitization routines on any custom integrations or middleware handling requests before they reach the vulnerable component. Deploying Web Application Firewalls with rules specifically tuned to detect code injection patterns can provide an additional layer of defense against exploitation attempts. Additionally, restricting network access to the /api/v1/prediction/ endpoint to trusted IP addresses and enforcing strong authentication mechanisms will reduce the attack surface available to remote adversaries. Regular security audits and penetration testing focused on API endpoints are essential to identify similar weaknesses in other parts of the application before they can be exploited.