External risk intelligence

Flowise Remote Code Execution via Prediction Endpoint

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-52098

Flowise is a platform for building LLM apps and agents that typically exposes API endpoints to facilitate integration and web application functionality. As these services are frequently deployed as internet-facing APIs or web-based management interfaces for automation workflows, the vulnerable endpoint is commonly reachable from the public internet.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in Flowise could allow unauthorized remote code execution through a specific API endpoint. Flowise is used for building AI applications and agents, and the nature of this endpoint suggests it might be internet-facing, potentially exposing connected systems to risk if not properly assessed. The main concern at this stage is confirming if this technology is in use and if the affected endpoint is accessible.

Remote code execution risk in AI app builder.
Threat to any system integrating with the builder.
Confirm relevance and exposure of this technology.

Attack Path

How an attacker could exploit the issue

An attacker can target the Flowise API by sending a specially crafted request to the `/api/v1/prediction/<flowId>` endpoint. This endpoint, which is exposed externally and does not require authentication, can be manipulated to execute arbitrary code on the server.

Attacker sends requests to the API.
Vulnerable endpoint processes malicious input.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

The Flowise `/api/v1/prediction/<flowId>` endpoint could allow an unauthenticated remote attacker to execute arbitrary code. This could occur when the application's API is accessible over a network.

Arbitrary code execution on the server.
Remote unauthenticated network access.
Compromise of the host system.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this critical vulnerability in Flowise, as it exposes an endpoint that can be reached remotely and allows for arbitrary code execution. The first practical move is to identify all instances of Flowise, determine their business criticality and network exposure, and then assign ownership to the appropriate team for remediation planning.

Application owners should own the issue.
Verify external exposure and business criticality.
Plan remediation, considering vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Flowise?

Flowise is a platform designed for building applications and agents powered by Large Language Models (LLMs). It provides a visual interface and API tools that allow developers to construct complex automation workflows, often acting as a bridge between LLMs and other software services.

How does CVE-2026-52098 allow code execution?

This vulnerability is classified as CWE-94, or Improper Control of Generation of Code. It means the software incorrectly handles input provided to the /api/v1/prediction/<flowId> endpoint, allowing an attacker to inject and execute their own arbitrary commands on the underlying server that runs the Flowise platform.

Do I need to be authenticated to trigger this vulnerability?

No, authentication is not required to trigger this issue. The vulnerability exists because the specific API endpoint processes requests without verifying the identity of the sender. Simply sending a crafted request to the target endpoint is sufficient; legitimate user interaction or prior access credentials are not necessary preconditions for an attacker.

Is my Flowise instance at risk?

Your instance is at higher risk if it is internet-facing. According to Halo Surface Signal, Flowise is frequently deployed with API endpoints that are reachable from the public internet to facilitate web integration. If your deployment allows external network access to the /api/v1/prediction/<flowId> path, it is likely reachable by remote attackers.

What should I do first to manage this threat?

Your initial priority is to create an inventory of all Flowise instances within your environment. Once identified, confirm which of these services are accessible over the network and determine their business function. After assessing their exposure and importance, coordinate with your technical teams to begin planning for remediation steps as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.