Threat Intelligence Report — CVE-2026-52098

Executive Summary

CVE-2026-52098 is an unpatched remote code execution vulnerability affecting Flowise 3.1.2, an open-source low-code platform for building LLM applications and AI agents. The flaw resides in the /api/v1/prediction/<flowId> endpoint, which permits a remote attacker to execute arbitrary code. Any internet-exposed or internally reachable Flowise 3.1.2 instance is at risk; successful exploitation yields code execution in the context of the Flowise service account, with full compromise of the host process and any credentials, API keys, and data accessible to it. No CVSS score, EPSS score, CWE mapping, public PoC, or patch is currently available from any tracked source.

Technical Analysis

The NVD description states: "An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint."

Flowise is a Node.js/TypeScript application that enables users to visually compose LLM workflows ("flows") and expose them as callable prediction endpoints. The /api/v1/prediction/<flowId> route is the runtime invocation interface: a client supplies a flow identifier (<flowId>) in the URL path and a request body of input variables; the server loads the corresponding flow definition and executes it — invoking configured nodes, tools, and any embedded logic — before returning the model output.

The vulnerability is best classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The endpoint accepts attacker-influenced input to drive flow execution. Where a flow's definition includes executable components — custom function nodes, JavaScript/Python code blocks, tool callbacks, or template/interpolation steps — attacker-supplied input that reaches those components without adequate isolation or sanitization can be evaluated and executed by the server. This is the classic "flow engine as a code interpreter" failure mode for LLM orchestration platforms: the platform's core feature (executing user-defined logic) becomes the attack primitive when the prediction endpoint is reachable by untrusted callers.

Two attack-surface characteristics make this endpoint notable:

1. Remote and network-reachable. The route is part of the public HTTP API (/api/v1/...), so no local access, authentication bypass of the OS, or client-side interaction is required. Where deployments expose the Flowise UI/API without authentication or with weak/default API keys, the endpoint is directly callable from the internet.
2. Code execution context. The Node.js server process typically holds long-lived secrets: LLM provider API keys, database credentials, and platform configuration. Arbitrary code execution therefore translates directly into credential and data exposure, not merely process disruption.

The precise injection sink — which node type, parameter, or expression evaluator is abused, and whether authentication is required to reach the endpoint — cannot be stated from the available data. No function names, class names, parameter names, or file paths beyond the /api/v1/prediction/<flowId> endpoint itself are disclosed in the NVD description or CNA title, and this report does not fabricate them. No CVSS vector, CWE, or EPSS score has been assigned by NVD, FIRST.org, or MITRE at the time of writing.

Exploitation Scenarios

Note: No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-52098. The attack chain below is inferred at the vulnerability-class level from the NVD description and standard exploitation patterns for unauthenticated RCE in self-hosted web applications. No specific function names, parameters, or code patterns are invented.

1. Reconnaissance / target identification. An attacker enumerates internet-facing hosts and fingerprints Flowise instances using the UI title, favicon hash, or known static asset paths (Shodan/Censys-style scanning). Targets of interest are Flowise 3.1.2 deployments exposed on TCP 3000 (the common default) or behind reverse proxies, particularly those without authentication or with default/weak API credentials.

2. Triggering the flaw class. The attacker sends a crafted request to the /api/v1/prediction/<flowId> endpoint, supplying a valid or guessable flow identifier in the path and a maliciously constructed request body. Because the endpoint's purpose is to accept caller input and feed it into flow execution, the attacker uses that input as the injection vector into an executable component of the flow.

3. Payload/execution method (class level). Code-injection (CWE-94) exploitation: the attacker-supplied input is evaluated/executed by the server rather than treated as inert data. At the class level, this permits execution of arbitrary operating-system commands or server-side code with the privileges of the Flowise process. The attacker needs no local access and, depending on deployment configuration, may need no authenticated session — the exact precondition for authentication is not specified in the available data.

4. Post-exploitation impact. Arbitrary code execution under the Flowise service account enables: exfiltration of environment variables and configuration containing LLM provider API keys, database connection strings, and platform secrets; lateral movement into connected services (databases, vector stores, internal APIs referenced by flows); persistence via scheduled tasks or modified flow definitions; and, where the process runs with elevated privileges or host mounts, full host compromise.

Because no public exploit exists, exploitation in the wild has not been confirmed. SOC teams should treat scanning activity against /api/v1/prediction/ on Flowise hosts as a high-priority indicator.

Impact Assessment

Confidentiality: High. The Flowise process holds API keys, database credentials, and tenant flow data; RCE exposes all of it. Integrity: High. An attacker can modify flow definitions, inject persistence, and alter model outputs. Availability: High. The process, host, or dependent services can be disrupted or destroyed.

Blast radius extends beyond the Flowise host: flows commonly integrate LLM providers, vector databases, internal HTTP tools, and enterprise data sources, so a single compromise can pivot into those connected systems. Self-hosted Flowise deployments are frequently internet-exposed for convenience, amplifying exposure. Because no CVSS score has been assigned, no standardized severity rating is available — but the combination of remote reachability, no listed privilege requirement, and code execution warrants treatment as Critical for any exposed instance.

Business impact includes credential compromise and rotation effort across all integrated services, potential regulatory exposure if prompt/flow data contains sensitive information, and supply-chain risk for downstream applications consuming Flowise-hosted models.

Detection Guidance

Sigma Rule

title: Flowise Prediction Endpoint Exploitation Attempt (CVE-2026-52098)
id: 8f2c1a44-3d5e-4b21-9a7c-0e6d1f7b5209
status: experimental
description: Detects requests to the Flowise /api/v1/prediction/ endpoint potentially exploiting CVE-2026-52098 for remote code execution.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-52098
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains: '/api/v1/prediction/'
  selection_method:
    cs-method: 'POST'
  selection_suspicious:
    cs-uri-query|contains:
      - '..'
      - '${'
      - '<%'
      - 'require('
      - 'child_process'
      - 'eval('
      - 'exec('
  condition: selection_uri and selection_method
falsepositives:
  - Legitimate application invocations of prediction flows
  - Security scanners in authorized testing
level: high
tags:
  - attack.t1190
  - cve.2026-52098

YARA Rule

rule CVE_2026_52098_Flowise_Prediction_RCE
{
    meta:
        description = "Detects exploitation artifacts for CVE-2026-52098 in Flowise prediction endpoint traffic/logs"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-52098"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep = "/api/v1/prediction/" ascii wide
        $c1 = "child_process" ascii
        $c2 = "require(" ascii
        $c3 = "eval(" ascii
        $c4 = "exec(" ascii
        $c5 = "process.env" ascii

    condition:
        $ep and any of ($c*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-52098 Flowise Prediction Endpoint RCE Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/prediction/"; http.request_body; content:"child_process"; nocase; classtype:web-application-attack; reference:cve,2026-52098; sid:202652098; rev:1;)

alert http any any -> any any (msg:"CVE-2026-52098 Flowise Prediction Endpoint Access"; flow:established,to_server; http.uri; content:"/api/v1/prediction/"; http.request_body; content:"require("; nocase; classtype:web-application-attack; reference:cve,2026-52098; sid:202652099; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "POST" and
      url.path : "/api/v1/prediction/*" ]
  [ process where event.action == "start" and
      process.parent.name : ("node", "nodejs", "npm") and
      process.name : ("sh", "bash", "cmd.exe", "powershell.exe", "curl", "wget", "python*", "nc" ) ]

This correlates a prediction-endpoint POST with a subsequent unexpected child process spawned by the Node.js runtime — a strong post-exploitation indicator of RCE on a Flowise host.

Splunk SPL Query

index=web OR index=flowise sourcetype=access_combined OR sourcetype=flowise:app
| search uri_path="/api/v1/prediction/*" method=POST
| eval suspicious = if(match(_raw, "(?i)(child_process|require\(|eval\(|exec\(|process\.env|\$\{|<%|\.\./)"), "YES", "NO")
| where suspicious="YES"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips values(uri_path) as paths by host
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Supplementary host-based hunt (Sysmon/EDR forwarded to Splunk):

index=edr EventCode=1
| search ParentImage="*node*"
| search Image IN ("*sh","*bash","*cmd.exe","*powershell.exe","*curl","*wget","*nc","*python*")
| table _time host User ParentImage Image CommandLine

Wazuh OSSEC Rule

<group name="flowise,web,cve-2026-52098,">
  <rule id="2026520" level="10">
    <if_sid>31100</if_sid>
    <url>/api/v1/prediction/</url>
    <description>CVE-2026-52098: Flowise prediction endpoint access (potential RCE attempt)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="2026521" level="12">
    <if_sid>2026520</if_sid>
    <match>POST</match>
    <regex>child_process|require\(|eval\(|exec\(|process\.env</regex>
    <description>CVE-2026-52098: Flowise prediction endpoint exploitation indicators in request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, fixed version, commit reference, or CVE fix data exists at time of writing. This must be treated as a zero-day condition.

1) Immediate mitigations (compensating controls):

• Remove internet exposure. Restrict Flowise to trusted internal networks only; block external access to TCP 3000 (or the configured port) at the perimeter and host firewall.
• Enforce authentication and strong API keys. Require authentication for all API routes; rotate any default or weak credentials immediately.
• Restrict network egress from the Flowise host to only the destinations required by its integrations, limiting exfiltration and pivot options.
• Run least-privilege. Execute the Flowise service under an unprivileged, containerized account with no host mounts and read-only filesystem where feasible.
• Block or rate-limit requests to /api/v1/prediction/* from untrusted sources at the reverse proxy (e.g., nginx/Envoy WAF rules matching the Suricata signatures above).
• Do not host untrusted flows. Treat flow definitions as trusted code; any user able to create or edit flows should be considered effectively privileged.

2) Patch/upgrade steps (when available):

• Monitor the Flowise GitHub releases and security advisories for a fixed version; upgrade immediately to the first release that references CVE-2026-52098.
• Until a fix ships, consider migrating to a maintained alternative deployment or an isolated instance dedicated to non-sensitive workloads.
• After upgrading, rotate all secrets exposed to the previously vulnerable host (LLM API keys, DB credentials, platform tokens).

3) Long-term hardening:

• Adopt a patch-management SLA for self-hosted AI/LLM tooling; these platforms are frequently exposed and under-monitored.
• Maintain network segmentation separating AI orchestration services from production data stores and internal APIs.
• Implement egress filtering and runtime detection (EDR on Node.js hosts) with alerting on child processes spawned by the Node runtime.
• Conduct authenticated and unauthenticated scanning of AI platform endpoints quarterly.

References

• NVD — CVE-2026-52098: https://nvd.nist.gov/vuln/detail/CVE-2026-52098
• Flowise Project (GitHub) — release/security advisories: https://github.com/FlowiseAI/Flowise
• Flowise Documentation — deployment and authentication guidance: https://docs.flowiseai.com/
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-52098 not listed at time of writing)

Threat actor / ITW status: No known threat actor campaigns, public exploit code, or exploit-in-the-wild evidence have been identified for CVE-2026-52098. The absence of a public PoC reduces opportunistic mass-exploitation risk in the short term, but does not eliminate targeted risk — the vulnerability is remotely reachable and unpatched, making proactive detection and exposure reduction the priority.