{"vulnerability": "cve-2026-5627", "sightings": [{"uuid": "30f1cc06-2757-4504-85f5-b1bbb943addb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5627", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mivyjoek5x26", "content": "", "creation_timestamp": "2026-04-07T14:30:18.679337Z"}, {"uuid": "22eb63f0-09f9-4eda-8d82-fa9c46fa3609", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5627", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116363900721699665", "content": "", "creation_timestamp": "2026-04-07T14:30:22.412018Z"}, {"uuid": "be9fb8f1-eee7-4116-957e-37d71e111cad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5627", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mivzdlyidt2s", "content": "", "creation_timestamp": "2026-04-07T14:44:48.210613Z"}, {"uuid": "9f45b1bf-fbbd-4327-b182-770467065ffc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5627", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miw3ztb2m22s", "content": "", "creation_timestamp": "2026-04-07T15:33:03.185243Z"}, {"uuid": "13379a7f-ae0c-40dc-a273-ac952c9204a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5627", "type": "published-proof-of-concept", "source": "Telegram/OQovZCNyncHtmKsEQoVAn9WglYI3Qk-HPEu8DU-i8r2-BaQ", "content": "", "creation_timestamp": "2026-04-07T15:21:30.000000Z"}, {"uuid": "aef37621-9e13-42b5-b914-7d01593e9ae1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56276", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moqmuihsev2i", "content": "CVE-2026-56276 - Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override\nCVE ID : CVE-2026-56276\n \n Published : June 20, 2026, 3:24 p.m. | 4\u00a0hours, 18\u00a0minutes ago\n \n Description : Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api...", "creation_timestamp": "2026-06-20T19:49:30.203076Z"}, {"uuid": "f6fd408c-a0ea-4383-b928-2572362211f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56274", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moxmasquup2a", "content": "CVE-2026-56274 - Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess\nCVE ID : CVE-2026-56274\n \n Published : 23 juin 2026 12:13 | 1\u00a0heure, 30\u00a0minutes ago\n \n Description : Flowise before 3.1.2 contains multiple OS co...", "creation_timestamp": "2026-06-23T14:27:06.959345Z"}, {"uuid": "0f87b050-9e88-42d1-bf81-8420412ac44b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56270", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp22xcos3g2f", "content": "CVE-2026-56270 - Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint\nCVE ID : CVE-2026-56270\n \n Published : June 24, 2026, 11:53 a.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing...", "creation_timestamp": "2026-06-24T13:55:31.485115Z"}, {"uuid": "35a2507a-0993-4f14-91e6-47df3bbe3445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-56274", "type": "seen", "source": "https://gist.github.com/muhamedfazalps/db2c0e46436e75ee35dd214e14e27b40", "content": "# CVE-2026-56274: Critical OS Command Injection in Flowise\n\n**CVSS 9.9 (Critical) | Disclosed: June 24, 2026 | Unpatched**\n\n## Summary\nCVE-2026-56274 is an OS command injection vulnerability in FlowiseAI Flowise before version 3.1.2, specifically in the Custom MCP Server feature.\n\n## Technical Details\n- **CWE**: CWE-78 (OS Command Injection)\n- **CVSS Vector**: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n- **Attack Type**: Remote (network)\n- **Privileges Required**: Low (any authenticated user)\n- **Impact**: Complete compromise of confidentiality, integrity, and availability\n\nThe vulnerability consists of two bypasses:\n1. Incomplete command-flag validation (e.g., `docker build` not blocked, `npx --yes` not blocked)\n2. Regex bypass in local file access restrictions\n\n## Affected\n- FlowiseAI Flowise < 3.1.2\n- Note: Flowise was acquired by Workday (NASDAQ: WDAY) in August 2025\n\n## Mitigation\n- Disable Custom MCP Server feature\n- Restrict API access\n- Monitor for unusual child processes\n- Network segmentation\n\n## References\n- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56274\n- Full Article: https://muhamedfazalps.github.io/security-alerts-june-2026/blog/cve-2026-56274-flowise-rce.html\n\n---\n*If this analysis helped you, consider supporting security research: https://buymeacoffee.com/muhamedfazalps*", "creation_timestamp": "2026-06-25T05:40:10.554880Z"}, {"uuid": "4820d558-400c-4b93-b4e1-218f48ffbb7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56278", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpkjkz7hy72o", "content": "CVE-2026-56278 - Flowise - Session Hijacking via Weak Default Express Session Secret\nCVE ID : CVE-2026-56278\n \n Published : June 30, 2026, 10:08 p.m. | 3\u00a0hours, 4\u00a0minutes ago\n \n Description : Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded def...", "creation_timestamp": "2026-07-01T02:59:40.779486Z"}, {"uuid": "a7713221-4f5a-4b75-ba1f-82cb694d1682", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56278", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpzl46bhfg2b", "content": "\ud83d\udccc CVE-2026-56278 - Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when t... https://www.cyberhub.blog/cves/CVE-2026-56278", "creation_timestamp": "2026-07-07T02:37:06.497953Z"}, {"uuid": "592fde26-fb75-4cae-aa25-259a0ccd2f50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56270", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqbxdatcfq26", "content": "\ud83d\udccc CVE-2026-56270 - Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows una... https://www.cyberhub.blog/cves/CVE-2026-56270", "creation_timestamp": "2026-07-10T10:37:06.906695Z"}, {"uuid": "97d9f883-fce1-427e-bd1e-1a54d2d207c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56274", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqc2ojfhn72n", "content": "\ud83d\udccc CVE-2026-56274 - Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation... https://www.cyberhub.blog/cves/CVE-2026-56274", "creation_timestamp": "2026-07-10T11:37:06.590194Z"}, {"uuid": "0ea0207e-cc24-4fba-bcdb-5030d89d9174", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56279", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd3frisgd2x", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56279 \u0432 Capgo: \u0443\u0433\u0440\u043e\u0437\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\n\nhttps://kripta.biz/posts/C5610CAA-17E5-4191-A45C-E7E8825E9C3E", "creation_timestamp": "2026-07-10T21:22:45.871488Z"}, {"uuid": "702f9e63-0001-4953-b1d0-cbe92f011f8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56279", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqgm7y2z7525", "content": "\ud83d\udfe0 CVE-2026-56279 - High (7.5)\n\nCapgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid)...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-56279/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-12T07:01:44.848589Z"}, {"uuid": "0acbb9a3-7d56-4ba8-9f77-70938c87ba78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56271", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqh6qvmwwo2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56271 \u0432 Flowise: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/CC8F73D0-809A-4082-AF00-34E8DF898442", "creation_timestamp": "2026-07-12T12:33:19.767402Z"}, {"uuid": "c6f165cc-2945-45ec-aac7-627c7a0c21cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56271", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqh7hpkdws2f", "content": "CVE-2026-56271 - flowise\nFlowise versions 3.0.13 and earlier use weak default secrets in its JWT authentication system. This allows attackers to create fake authentication tokens, potentially impersonating\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#flowise #CVE #infosec", "creation_timestamp": "2026-07-12T12:46:05.288356Z"}, {"uuid": "50a58aa2-fe29-4106-8cfb-fbdb7c321937", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56271", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqh7wndsdd2w", "content": "CVE-2026-56271 - Flowise - Weak Default JWT Secrets in Authentication Middleware\nCVE ID : CVE-2026-56271\n \n Published : July 12, 2026, 12:16 p.m. | 16\u00a0minutes ago\n \n Description : Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secre...", "creation_timestamp": "2026-07-12T12:54:26.276247Z"}, {"uuid": "33d5488c-b96e-4ffd-8de5-92a19cc9a533", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56271", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqhacgw2kj2c", "content": "\ud83d\udd34 CVE-2026-56271 - Critical (9.8)\n\nFlowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secre...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-56271/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-12T13:01:03.545973Z"}, {"uuid": "32110028-52fd-48a3-a687-956e95b732ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56271", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqivyyahck2h", "content": "CVE-2026-56271 - flowise\nFlowise has weak default JWT secrets that can be used by attackers to impersonate any user, potentially leading to complete authentication bypass and unauthorized access to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#flowise #henryheng #npm #CVE #infosec", "creation_timestamp": "2026-07-13T05:02:06.599023Z"}, {"uuid": "694d8928-137e-48cf-b24d-745b55efff75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56271", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkxd3rand2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56271 \u0432 Flowise: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/019BF5B0-AE55-42EB-B292-1B822DCF3FF7", "creation_timestamp": "2026-07-14T00:30:59.262257Z"}, {"uuid": "ee29cb80-b518-490b-910a-61b5b54f06eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56271", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqlc4nbx7d2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56271 \u0432 Flowise: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/BB98A4DD-AF5E-49EA-9558-94D17BC67523", "creation_timestamp": "2026-07-14T03:44:14.000785Z"}, {"uuid": "75eff869-f2e4-4514-8bff-e8b8c57d192a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56271", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqns6szms22f", "content": "\ud83d\udccc CVE-2026-56271 - Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audien... https://www.cyberhub.blog/cves/CVE-2026-56271", "creation_timestamp": "2026-07-15T03:37:06.496356Z"}]}