Flowise AI Agent Builder Has a CVSS 10.0 RCE Exploit — 12,000+ Instances at Risk

On April 8, 2026, The Hacker News and multiple security researchers confirmed that Flowise — one of the most popular open-source AI agent builder platforms — has a remote code execution vulnerability rated CVSS 10.0. That is the highest possible severity score in the Common Vulnerability Scoring System. The exploit requires no authentication. An attacker on the open internet can run arbitrary code on your server just by sending a crafted HTTP request to a publicly exposed Flowise instance.

What Is Flowise?

Flowise is an open-source, drag-and-drop tool for building AI agents and LLM pipelines. It launched in 2023 and quickly became one of the most starred AI projects on GitHub, with hundreds of thousands of downloads. Developers and small businesses use it to visually chain together language models, vector databases, and external APIs to build chatbots, research agents, and automation workflows.

Its popularity among indie developers and bootstrapped startups means that most deployments are self-hosted on VPS instances, cloud VMs, or home servers — often without robust security hardening.

The Vulnerability: CVSS 10.0, Unauthenticated RCE

The vulnerability is classified as a Remote Code Execution (RCE) flaw. CVSS 10.0 means:

• No authentication required: An attacker does not need a username or password
• Network accessible: It is exploitable remotely over the internet
• Full system compromise: A successful exploit gives the attacker full control of the host machine
• Zero user interaction needed: The victim does not need to click anything

In practical terms: if your Flowise instance is reachable on a public IP and running an affected version, an attacker can take over your entire server, access your API keys (OpenAI, Anthropic, database credentials, webhooks), exfiltrate your agent configurations, and use your server for further attacks.

Scale of the Exposure

Security researchers using Shodan and Censys — tools that scan the public internet for exposed services — identified over 12,000 Flowise instances publicly accessible without authentication or TLS protection as of April 8, 2026. Active exploitation in the wild has been confirmed.

This is not a theoretical risk. Attacks are happening now.

Who Is Most at Risk?

Immediate Steps If You Run Flowise

1. Update Flowise now. Pull the latest version from the official GitHub repository. The patch addresses the RCE vector. Do not wait.
2. If you cannot update immediately, take it offline. Restrict access to your Flowise port (default 3000) via firewall rules. Block all public access until you can patch.
3. Rotate all API keys stored in Flowise. Even if you patch, assume your stored credentials (OpenAI key, Anthropic key, database URLs, webhook tokens) may have been exfiltrated. Rotate them in every connected service.
4. Enable authentication. Flowise supports a username/password login. Enable it. This should always be on for any publicly accessible instance.
5. Run Flowise behind a reverse proxy with HTTPS. Nginx or Caddy in front of Flowise, with TLS, adds a meaningful layer of protection.
6. Audit your server logs. Look for unexpected HTTP requests to Flowise endpoints from unfamiliar IPs, especially before you patched.

The Bigger Picture: AI Tool Security Is Now a Front-Line Problem

The Flowise vulnerability is not an isolated incident. It reflects a systemic issue in the AI builder ecosystem: the explosive adoption of self-hosted AI tools by developers who are not infrastructure security specialists.

In 2024–2025, builders rushed to set up open-source AI stacks — Flowise, LangFlow, Dify, Open WebUI, Ollama, and dozens of others — often deploying them quickly without security hardening. Many of these tools were never designed for production-grade public internet exposure. They were prototyping tools that became production workhorses.

A separate 2026 report from AI News found that only 21% of companies deploying AI agents have adequate governance and security safeguards. The Flowise exploit is a real-world manifestation of that gap.

Attackers are not targeting AI tools randomly. They are targeting them specifically because:

• AI tool servers often contain high-value API credentials worth money on resale markets
• Compromised AI agent infrastructure can be used for prompt injection attacks on downstream users
• AI builders tend to underestimate attack surface compared to traditional web developers

Self-Hosted vs. Cloud-Managed AI Tools: A Security Trade-Off

AI Security Predictions for the Rest of 2026

The Flowise exploit is likely the first of many AI-specific CVEs in 2026. As AI tooling matures and more organizations deploy AI agents at scale, the attack surface expands. Security researchers predict:

• More self-hosted AI tool CVEs: LangFlow, Dify, and Open WebUI are all on security researchers' radar for similar issues
• Prompt injection as a formal CVE category: Attacks that manipulate AI agent behavior may receive CVSS scores by late 2026
• Supply chain attacks on AI packages: Malicious packages disguised as LangChain or LlamaIndex extensions targeting PyPI and npm
• AI credential theft market: A growing black market for stolen AI API keys, given their direct monetization value

Key Takeaways

• Flowise CVSS 10.0 RCE is being actively exploited against 12,000+ exposed instances
• Update immediately or take your instance offline
• Rotate all API keys stored in any compromised Flowise instance
• AI tool security is now a front-line concern, not an afterthought
• Cloud-native platforms eliminate this category of operational risk