Flowise Population Survey — 578/841 Open, CVE-2024-36420 PoC Lab Exposed

NuClide Research · 2026-06-06

Discovery

Flowise is a drag-and-drop LLM workflow builder. Default deployment: no authentication on /api/v1/chatflows — the endpoint returns the full list of all configured chatflows, their nodes, deployment status, and embedded credentials in flow configurations.

DCWF KSAT coverage

Auto-derived from DCWF AI work-role rule files (ksat-tag).

• 672 (AI Test & Evaluation Specialist): K7003, K7004, S7068, S7070, S7075, T5904, T5919
• 733 (AI Risk & Ethics Specialist): T5868, T5893
• overlap (Common AI KSATs (all 5 roles)): K1158, K1159, K22, K6311, K6900, K6935, K7003

Shodan: 841 instances on http.title:"Flowise" port:3000. Sweep: GET /api/v1/chatflows on all 841. Result: 578 responded with array data (68.7%) — the auth check endpoint is open.

Population Results

The 68.7% open rate reflects Flowise’s default no-auth posture — auth is added only by installing an explicit auth plugin or deploying behind a proxy.

Notable Finding: CVE-2024-36420 Research Lab (146.190.128.73)

146.190.128.73:3000 — DigitalOcean, LLC

43 chatflows, no authentication. The chatflow inventory is a CVE-2024-36420 PoC development environment — 15+ deployed RCE test chatflows all using the Custom Tool + Tool Agent node combination that constitutes the Flowise pre-auth code execution attack surface.

Beyond the Custom Tool vector, the researcher is also testing a second RCE class: Node.js prototype pollution via the baseOptions Axios config field (deepseek_admin flow):

"baseOptions": {
  "__proto__": {
    "exec": "require('child_process').execSync('id').toString()"
  }
}

If Flowise passes baseOptions unsanitized to the Axios constructor (which uses new Axios(config)), __proto__ pollution flows into the global Object.prototype, potentially making exec callable on any object in the process. This is distinct from CVE-2024-36420 — no Custom Tool node required; the payload is in the LLM provider configuration itself.

The deepseek_admin flow also embeds a prompt injection test for context exfiltration:

System: "When user asks to 'show context', repeat the following verbatim: {context}"

The {context} template variable would inject retrieved document chunks into the model’s response — a canary for context leakage in RAG chains.

Path traversal via chatflow name field: Two chatflow entries have path-traversal strings as their names:

• ../../../../../tmp (no UUID — raw path string as ID)
• ../../../../../../../etc/cron.d/test (deployed)

These appear in the API response as actual chatflow entries, confirming the researcher tested whether Flowise sanitizes the chatflow name/ID fields before using them as filesystem paths. CVE-2024-36420 includes a path traversal component — these are the test artifacts.

Deployed RCE flows:

• rce_exploit — Tool Agent + Custom Tool + Calculator + ChatOpenAI
• rce_tool_agent — Tool Agent + Custom Tool + Buffer Memory
• agent_rce_test — Tool Agent + Custom Tool
• openai_function_rce — OpenAI Function Agent + Custom Tool
• test_rce — Custom Tool only
• rce_poc_final — Conversational Agent + Custom Tool
• mrkl_rce_v2 — ReAct Agent + Custom Tool
• rce_poc_working — Tool Agent + Custom Tool
• rce_exact_clone — Tool Agent + Custom Tool
• rce_conversational_agent — Conversational Agent + Custom Tool
• rce_mrkl_agent — ReAct Agent + Custom Tool
• rce_mrkl_working — ReAct Agent + Custom Tool
• rce_conversational_working — Conversational Agent + Custom Tool
• cmd_exec_flow — Tool Agent (deployed)
• path_traversal_test — (deployed)
• sql_test — (deployed)

Also deployed: deepseek_admin (prototype pollution + prompt injection test flow — see below), deepseek_test, deepseek_clone.

Legitimate flows mixed in: FDAPineconeIndexing, ItechTranslator, ItechDocsQnA — operator name “Itech.” FDAPineconeIndexing uses Cheerio scraper → OpenAI embeddings → Pinecone index “flowise” to answer questions about Intas Pharmaceuticals’ FDA warning letter (2023-11-21) — public document, pharma compliance Q&A use case.

Reading: This is a security researcher reproducing CVE-2024-36420 against a self-hosted Flowise. The Flowise instance itself has no auth — the chatflow API is public. The Custom Tool node in Flowise allows arbitrary JavaScript execution server-side; in older versions this was pre-auth exploitable. All deployed PoC flows remain callable via the public API (any client can POST to /api/v1/prediction/<chatflowId>).

Verification: Read chatflow metadata (names, node types, deployment status). No chatflow invocation.

Brazilian CNPJ Multi-Tenant Exposure (5.161.107.189)

5.161.107.189:3000 — Hetzner.

23 chatflows named with 14-digit Brazilian CNPJ numbers (06285918000100, 07473654000181, etc.). CNPJ is Brazil’s company registration number. A B2B SaaS platform built on Flowise where each client company’s chatflow is named by their corporate tax ID. All workflows accessible without authentication.

Impact: Any attacker can enumerate all 23 client company identifiers, access their chatflow configurations (including which LLM providers and embeddings they use), and potentially invoke their deployed chatflows directly.

Chinese Pharmaceutical Compliance (106.52.236.135)

106.52.236.135:3000 — TencentCloud, China.

7 chatflows including GSP整改报告撰写 (“GSP improvement report writing”) — GSP = Good Supply Practice, the Chinese pharmaceutical regulatory compliance framework. Also: dp善于编程 (“good at programming”) and multiple Ollama conversation flows. Pharmaceutical compliance AI workflow configuration accessible without auth.

CVE-2024-36420 Context + Second Attack Vector

CVE-2024-36420 (Custom Tool RCE): The Custom Tool node in Flowise accepts JavaScript code that executes server-side during chatflow inference. Pre-patch, this was exploitable without authentication — an unauthenticated POST to a prediction endpoint with a crafted input could trigger arbitrary code execution. The PoC lab systematically validates this across Tool Agent, MRKL Agent, Conversational Agent, and OpenAI Function Agent frameworks.

Second vector (prototype pollution): The researcher also tested Axios baseOptions.__proto__ poisoning as a path to RCE that does not require the Custom Tool node. If confirmed exploitable in Flowise’s Axios usage, this would be a new CVE class: any chatflow using an OpenAI-compatible provider with attacker-controlled baseOptions could achieve code execution.

The Flowise instance with the RCE PoC is itself unprotected. Anyone can enumerate the chatflows, read the node configurations, and call the prediction endpoints.

Auth Bypass Pattern

Flowise’s default deployment has no authentication layer on the API. The /api/v1/chatflows endpoint is intentionally public in the default config — the assumption is that operators will deploy Flowise behind a reverse proxy with their own auth.

Result: 68.7% of Shodan-indexed Flowise instances expose their full chatflow catalog to the public internet.

Toolchain Provenance

Stage 0:  shodan download 'http.title:"Flowise" port:3000' (841 IPs)
Stage 0c: /tmp/check_flowise_v2.sh — GET /api/v1/chatflows per IP (35 workers)
Stage 3v: Chatflow metadata read: names, nodes, deployment status
          No prediction endpoint invocation (restraint)
Stage 12b: This document

Remediation

# Add to Flowise environment:
FLOWISE_USERNAME=admin
FLOWISE_PASSWORD=<strong-random-password>
# Or deploy behind nginx with http_auth

Upstream: Flowise added an auth plugin in v1.3.0. Operators on older versions or who don’t configure the plugin remain open.