[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuyjNnzk8AjDZStRQuwqgkPajOozdNp6Ylz0orm_tAEI":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"16393548-e7d0-48c9-b9d4-967755dee936","Exploit Code Published for Critical Flowise RCE Vulnerability","exploit-code-published-for-critical-flowise-rce-vulnerability-06827a","The one-click vulnerability allows attackers to execute arbitrary code on self-hosted Flowise servers by tricking users into importing a malicious chatflow. The post Exploit Code Published for Critical Flowise RCE Vulnerability appeared first on SecurityWeek.","Obsidian Security released proof-of-concept exploit code for CVE-2026-40933, a critical remote code execution vulnerability in Flowise, an open-source LLM platform with over 52,000 GitHub stars. The vulnerability stems from unsafe serialization in Anthropic's MCP protocol and allows attackers to execute arbitrary code on self-hosted servers by tricking users into importing a malicious chatflow. Flowise versions before 3.1.0 are vulnerable by default; the attack requires only user import of a crafted JSON chatflow to trigger OS-level code execution with Flowise process privileges.","Exploit code published for critical Flowise RCE vulnerability (CVE-2026-40933, CVSS 9.9)","https:\u002F\u002Fwww.securityweek.com\u002Fexploit-code-published-for-critical-flowise-rce-vulnerability\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-05-30T15:55:59+00:00","2026-05-30T16:00:08.342797+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"Flowise","product",{"name":21,"type":22},"Anthropic","vendor",{"name":24,"type":25},"Model Context Protocol (MCP)","technology",{"name":27,"type":22},"Obsidian Security",{"name":29,"type":25},"Docker","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":30,"icon":32,"name":33,"slug":34},null,"Zero-day","zero-day",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[52],{"type":53,"value":54,"context":55},"cve","CVE-2026-40933","Critical RCE vulnerability in Flowise, CVSS 9.9, unsafe serialization in MCP adapter",[21,27,18],{"controls":58,"vendors":137},[59,88,114],{"slug":60,"name":61,"problem":62,"products":63},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[93,101,106],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":102,"product_name":103,"url":104,"description":105},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":115,"name":116,"problem":117,"products":118},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[119,125,132],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":126,"product_name":129,"url":130,"description":131},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":133,"product_name":134,"url":135,"description":136},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[138],{"slug":139,"name":27,"logo_path":140,"roles":141},"obsidian-security","\u002Fvendor-logos\u002Fobsidian-security.png",[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"critical-rce-vulnerability-in-popular-llm-platform-highlights-serialization-risks","Critical RCE Vulnerability in Popular LLM Platform Highlights Serialization Risks","A critical remote code execution vulnerability in Flowise, an open-source LLM platform, demonstrates how unsafe serialization can lead to complete system compromise. The flaw allows attackers to execute arbitrary code simply by tricking users into importing a malicious JSON chatflow file, leveraging unsafe deserialization in the underlying MCP protocol. With proof-of-concept exploit code now publicly available and over 52,000 organizations potentially using this platform, the vulnerability represents a significant supply chain risk. This incident underscores the importance of secure coding practices in serialization processes and the need for comprehensive input validation in application workflows.",[148,149,150,151,152],"CIS Control 7","NIST SP 800-53 SI-2","OWASP A08:2021 Software and Data Integrity Failures","CIS Control 16","NIST SP 800-218 SSDF",{}]