CVE-2026-52098

⛔ critical

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint

CVSS Score

9.8

Critical

EPSS Score

0.8

Exploit Probability

Published Date

2026-09-10

First Seen: 2026-09-11

This CVE is Very High Risk - more severe than 90.5% of all 358,566 vulnerabilities in our database.

#34,002

Top 10% most severe

Severity Percentile

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2026-09-15

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-94

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
flowiseai	flowise	Affected	v3.1.2

Product

Product

Product

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-90580	🔶 medium	6.3	0.2	A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the fi...	2026-09-13
CVE-2026-90533	🔶 medium	6.5	0.2	Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any auth...	2026-09-12
CVE-2026-90534	🔶 medium	6.5	0.2	Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/no...	2026-09-12
CVE-2026-90535	⚠️ high	7.5	0.3	Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/a...	2026-09-12
CVE-2026-73483	⚠️ high	8.8	0.6	Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/no...	2026-08-13
CVE-2026-73484	⚠️ high	8.1	0.4	Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas...	2026-08-13

These CVEs affect the same products