2 CRIT · 6 HIGH · 2 MED · 2 INFO · THREAT RED · 12 items · Generated in 241s
Default unauthenticated Flowise can be forced to auto-install and run attacker-chosen packages, leading to remote code execution.
Tenant-scoped reads can leak another user's data when namespace names share prefixes.
Authenticated users can use the server to reach internal or cloud metadata endpoints and read sensitive responses.
Any authenticated user may trigger SSRF through the AI Gateway and access internal services or cloud metadata.
Read-only users can view server-side tool code and possibly embedded secrets, exposing internal logic and credentials.
Authenticated users can make the loader reach internal services and leak retrieved data into search or RAG output.
Lets an authenticated attacker bypass SSRF checks and fetch internal resources via DNS rebinding.
Revoked users can still trigger server-side image generation, bypassing intended access controls and consuming privileged AI features.
A one-click flaw in an enterprise AI tool could let attackers steal sensitive data from connected business platforms.
This changes default agent behavior and raises scrutiny on prompt injection and approval safety claims, but no concrete incident is reported.
It highlights practical attack paths like poisoned agent instructions and trusted defaults that can lead to compromise.
Shows developer pressure for safer defaults in AI coding tools, which affects trust and adoption but is not a specific disclosed flaw.