CRITICAL 9.8 NVD
CVE-2026-52098
An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint
An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint
References
- https://github.com/FlowiseAI/Flowise
- https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/utils/constants.ts
- https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/utils/validateKey.ts
This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-09-10 via NVD.
Risk Timeline
CVE Disclosed2026-09-10 · 1 day ago
Remediation Resources
vulnfeed aggregates 12842 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.