CVE-2026-30822

low-risk

Published 2026-03-07

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13.

Do I need to act?

0.19% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.7/10 High

NETWORK / HIGH complexity

Affected Products (1)

Flowise

Affected Vendors

Flowiseai

References (2)

Product https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13

Exploit https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-mq4r-h2gh-qv7x

/ 100

low-risk

Severity 23/34 · High

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal