Flowise — PoC Archivehttps://poc.intelseclab.com/tags/flowise/Latest proof-of-concept entries.Hugoen-usSun, 12 Jul 2026 00:00:00 +0000Flowise Enterprise Authentication Bypass via Hardcoded Default JWT Secrets (CVE-2026-56271)https://poc.intelseclab.com/pocs/web/2026-07-12_cve-2026-56271-flowise-hardcoded-jwt-authbypass/Sun, 12 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-12_cve-2026-56271-flowise-hardcoded-jwt-authbypass/Critical severity (CVSS 9.8) — web · CVE-2026-56271 (GHSA-cc4f-hjpj-g9p8). Status: Weaponized (functional PoC forges valid admin JWTs and confirms bypass against real endpoints). Affects: Flowise — open-source low-code LLM/agent orchestration platform (enterprise edition, passport authentication middleware). Tags: flowise, ai-gateway, llm-orchestration, jwt, hardcoded-secret, authentication-bypass, cwe-321, unauthenticated, remote, privilege-escalation.webCriticalflowiseai-gatewayllm-orchestrationjwthardcoded-secretauthentication-bypasscwe-321unauthenticatedremoteprivilege-escalationFlowise CustomMCP Unauthenticated Remote Code Execution via Function() Constructor (CVE-2025-59528)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-59528-flowise-custommcp-function-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-59528-flowise-custommcp-function-rce/Critical severity (CVSS 10) — web · CVE-2025-59528. Status: Weaponized. Affects: Flowise (FlowiseAI/Flowise). Tags: flowise, rce, custommcp, function-constructor, javascript-injection, unauthenticated, llm, node-load-method, cwe-94.webCriticalflowisercecustommcpfunction-constructorjavascript-injectionunauthenticatedllmnode-load-methodcwe-94Flowise NVIDIA NIM Endpoint Authentication Bypass — CVE-2026-30824https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30824-flowise-nvidia-nim-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30824-flowise-nvidia-nim-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-30824. Status: Weaponized. Affects: Flowise (NVIDIA NIM integration endpoints). Tags: flowise, nvidia-nim, auth-bypass, cwe-306, token-theft, container-management, python, unauthenticated.webCriticalflowisenvidia-nimauth-bypasscwe-306token-theftcontainer-managementpythonunauthenticatedFlowise Custom MCP Environment Variable Case Bypasshttps://poc.intelseclab.com/pocs/web/2026-07-03_flowise-mcp-env-var-case-bypass/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-03_flowise-mcp-env-var-case-bypass/High severity — web · None assigned as of 2026-07-03. Status: PoC. Affects: Flowise / flowise-components. Tags: flowise, mcp, model-context-protocol, windows, environment-variable, case-insensitivity, node-options, rce.webHighflowisemcpmodel-context-protocolwindowsenvironment-variablecase-insensitivitynode-optionsrce