Flowise: sandbox escape allowing authenticated command execution (CVE-2026-119978), no fix yet
Published 03/11/2026 02:13
Timeline
2 events over 11 h
- 02/11/2026 14:17ConfirmedBSI CERT-Bund (WID)+11 h
- 03/11/2026 02:13Published on WatchtowerPro CISO
In short
Flowise, the AI workflow tool, has a sandbox escape through version 3.1.4. A logged-in user can run commands on the server when ALLOW_BUILTIN_DEP=true. BSI CERT-Bund warns that no patch exists yet. Shodan recognises at least 3,534 internet-facing Flowise servers worldwide, 908 of them in the EU (03/11/2026); the real number is likely higher, and how many run an affected version is not yet known.
How bad is it
High. An attacker with a valid login on a vulnerable Flowise server can run their own commands on it, when the setting ALLOW_BUILTIN_DEP is switched on.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
CVSS 4.0 from NVD, from vulncheck.com, read 03/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginA user account
- A user to clickNo
- Special settingsUsually yes
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Flowise through 3.1.4, according to the NVD text copied into a third-party GitHub issue. Instances with ALLOW_BUILTIN_DEP=true are affected.
What to do now
- No fixed version has been named yet. Watch the Flowise GitHub releases and security advisories and install the fixed version as soon as one is published.
- Check whether the environment variable ALLOW_BUILTIN_DEP is set to true. If it is and your flows allow it, set it to false and restart Flowise.
- Keep Flowise off the internet, for example behind a VPN or IP allowlist, and limit who has an account.
- Interim measures reduce exposure and do not make a server safe.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer and all 1 source with their dates. And technology matching: which of your systems run Flowise, at which version, fixed or not - and what each one needs.