{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "1288",
  "slug": "flowise-9-8-flaw-exploited-in-the-wild",
  "edition": "2026-11-09T00",
  "url": "https://hangingcontext.com/stories/2026-11-09/flowise-9-8-flaw-exploited-in-the-wild/",
  "newsroom": "artificial-intelligence",
  "beat": "infrastructure",
  "newsroom_title": "Artificial Intelligence",
  "angle": "Flowise's critical flaw is being exploited live by the Greeter framework — and OpenAM has three critical flaws of its own.",
  "headline": "The exploit is already live: Flowise's 9.8 flaw is being used in the wild",
  "dek": "A critical Flowise flaw is being exploited in the wild, hundreds of exposed instances lack authentication, and OpenAM has three critical flaws of its own.",
  "published_at": "2026-11-09T00:43:27Z",
  "labels": {
    "trust": "confirmed",
    "trust_text": "Confirmed · 4 Manifests",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 4,
  "publishers": [
    "david-senra",
    "jump-capital-insights",
    "ostorlab-research"
  ],
  "sources": [
    "david-senra",
    "jump-capital-insights",
    "ostorlab-research"
  ],
  "distinct_source_count": 3,
  "key_facts": [
    {
      "text": "The Greeter framework exploited the Flowise vulnerability on honeypots from July to October 2026.",
      "cites": [
        {
          "claim_ids": [
            "1794183187370018458"
          ],
          "manifest_id": "1794182905550017006"
        }
      ],
      "self_reported": false
    },
    {
      "text": "Era Security identified 4,372 internet-facing Flowise instances, with 703 lacking authentication.",
      "cites": [
        {
          "claim_ids": [
            "1794183187372018459"
          ],
          "manifest_id": "1794182905550017006"
        }
      ],
      "self_reported": false
    },
    {
      "text": "VulnCheck rates CVE-2024-58351 as a CVSS v3.1 9.8 Critical vulnerability.",
      "cites": [
        {
          "claim_ids": [
            "1794183187369018457"
          ],
          "manifest_id": "1794182905550017006"
        }
      ],
      "self_reported": false
    },
    {
      "text": "OpenAM versions before 16.1.4 are vulnerable to three critical security flaws, and the session token disclosure flaw is rated CVSS v4.0 10.0.",
      "cites": [
        {
          "claim_ids": [
            "1794145681373925256",
            "1794145681377925257"
          ],
          "manifest_id": "1794144915020924335"
        }
      ],
      "self_reported": false
    },
    {
      "text": "Attackers can use the Flowise vulnerability to perform host reconnaissance, steal credentials, and establish persistence.",
      "cites": [
        {
          "claim_ids": [
            "1794183187377018463"
          ],
          "manifest_id": "1794182905550017006"
        }
      ],
      "self_reported": false
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "Exploited, not just disclosed",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794183187369018457",
                "1794183187370018458",
                "1794183187372018459"
              ],
              "manifest_id": "1794182905550017006"
            }
          ],
          "markdown": "The Flowise vulnerability is no longer a disclosure waiting for an exploit. VulnCheck rates CVE-2024-58351 as a CVSS v3.1 9.8 Critical vulnerability, and the Greeter framework exploited it on honeypots from July to October 2026. Era Security identified 4,372 internet-facing Flowise instances, with 703 lacking authentication. The combination is the point: a critical flaw, live exploitation, and hundreds of exposed instances with no authentication in front of them."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794183187377018463"
              ],
              "manifest_id": "1794182905550017006"
            }
          ],
          "markdown": "What the flaw allows is the reason the exploitation matters. Attackers can use the vulnerability to perform host reconnaissance, steal credentials, and establish persistence. That is a sequence, not a single event: find the host, take the credentials, and stay. The implication for anyone running Flowise is direct. The question is not whether the flaw is serious — a 9.8 rating and live exploitation settle that — but whether a given instance is reachable and what an attacker would find there."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794183187372018459",
                "1794183187370018458"
              ],
              "manifest_id": "1794182905550017006"
            }
          ],
          "markdown": "The exposure numbers make the point concrete. Era Security identified 4,372 internet-facing Flowise instances, with 703 lacking authentication. Those 703 are the ones with no gate in front of them at all. The evidence does not say how many of them were compromised, and that gap matters: honeypot exploitation proves the flaw is being used, not that every exposed instance has been hit. But an unauthenticated, internet-facing instance running a flaw with live exploitation is the worst place to sit while that question stays open."
        }
      ]
    },
    {
      "heading": "OpenAM has three critical flaws of its own",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794145681373925256",
                "1794145681377925257",
                "1794145681389925263"
              ],
              "manifest_id": "1794144915020924335"
            }
          ],
          "markdown": "A second disclosure lands alongside the Flowise news. OpenAM versions before 16.1.4 are vulnerable to three critical security flaws. The session token disclosure flaw is rated CVSS v4.0 10.0. No public proof of concept exists for these vulnerabilities. That last fact cuts both ways: there is no public exploit code to copy, but there is also no public demonstration to measure the flaws against, so teams must act on the rating and the description rather than on observed attacks."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794145681377925257"
              ],
              "manifest_id": "1794144915020924335"
            }
          ],
          "markdown": "The 10.0 rating is on the session token disclosure flaw, and the name says what is at stake. A session token is what a system uses to recognise a user after login, so a flaw that discloses it is a flaw in the proof of identity itself. The evidence does not say whether these flaws are being exploited, and it does not say how widely the affected versions are deployed. What it says is that the flaws are critical, the session token flaw is rated 10.0, and there is no public exploit code yet. Treat the absence of public code as a pause, not as safety."
        }
      ]
    },
    {
      "heading": "The defences were built for humans",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794168053949987148"
              ],
              "manifest_id": "1794167714847986749"
            }
          ],
          "markdown": "Jump Capital argues that the defences most teams have were built for a different world. Traditional security stacks designed for human interaction are insufficient for autonomous agents that operate continuously and initiate actions without human intervention. An agent does not work office hours. It keeps working, keeps acting, and keeps presenting new surface to attack while nobody is watching."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794168053953987151",
                "1794168053946987147"
              ],
              "manifest_id": "1794167714847986749"
            }
          ],
          "markdown": "AI is also changing the attack itself. AI-powered attacks are compressing response times and creating opportunities for continuous testing and runtime protection. AI is changing the nature of cybersecurity threats, the speed of product development, and the requirements for competitive differentiation, according to Jump Capital. The same technology that shortens the time between disclosure and exploitation also shortens the time a defender has to respond."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794142206505921423",
                "1794142206513921427"
              ],
              "manifest_id": "1794141619009920860"
            }
          ],
          "markdown": "Nikesh Arora, speaking about Palo Alto Networks, puts the shift in plainer terms. AI is a transformative technology that democratizes intelligence and increases the cybersecurity attack surface. He believes that AI will reach a point of reliability where it can be trusted as much as a human expert within two to three years. The implication is uncomfortable: the tools that widen the attack surface are the same tools defenders will soon be expected to trust."
        }
      ]
    },
    {
      "heading": "What changes for builders",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794183187372018459",
                "1794145681377925257",
                "1794183187370018458"
              ],
              "manifest_id": "1794182905550017006"
            },
            {
              "claim_ids": [
                "1794145681377925257"
              ],
              "manifest_id": "1794144915020924335"
            }
          ],
          "markdown": "For a developer, the practical read is narrow. First, know whether your Flowise instance is one of the 4,372 internet-facing ones, and whether it is one of the 703 without authentication. Second, treat the OpenAM flaws as urgent on the strength of the 10.0 rating, not as safe because no public proof of concept exists. Third, assume the window between disclosure and exploitation is short: the Greeter framework was already exploiting the Flowise flaw on honeypots from July to October 2026."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794168053949987148",
                "1794168053953987151"
              ],
              "manifest_id": "1794167714847986749"
            },
            {
              "claim_ids": [
                "1794142206505921423"
              ],
              "manifest_id": "1794141619009920860"
            }
          ],
          "markdown": "The through-line is that exploitation is no longer the second act. The Greeter framework was already exploiting this flaw on honeypots from July to October 2026, and the defences built for human-paced work are the ones now being tested by agents that never stop. That is the shift Jump Capital and Arora are both describing, from different angles: the attack surface grows because intelligence gets cheaper, and the response time shrinks because the attacks get faster."
        }
      ]
    }
  ],
  "unresolved": [
    "How many of the 4,372 internet-facing Flowise instances, including the 703 without authentication, were actually compromised — the evidence shows honeypot exploitation, not compromise of those instances.",
    "Whether the OpenAM flaws are being exploited anywhere — no public proof of concept exists, and the evidence says nothing about live exploitation.",
    "How quickly teams operating autonomous agents can move to continuous testing and runtime protection, which Jump Capital says AI-powered attacks are creating an opportunity for."
  ],
  "decision_card": {
    "not_for": [
      "Anyone looking for a patch version or a fix timeline — the evidence gives neither",
      "Teams with no Flowise or OpenAM exposure"
    ],
    "useful_for": [
      "AI developers running Flowise or OpenAM",
      "Teams operating autonomous agents that act without human supervision"
    ],
    "compare_against": [
      "Whether your Flowise instance is internet-facing and authenticated",
      "The 10.0 rating on the OpenAM session token flaw, not the absence of public exploit code"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-11-09T00"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1794182905550017006",
    "1794144915020924335",
    "1794167714847986749",
    "1794141619009920860"
  ],
  "manifests": [
    {
      "title": "Flowise RCE Exploited by the Greeter Framework (CVE-2024-58351)",
      "source_url": "https://blog.ostorlab.co/flowise-rce-greeter-framework-cve-2024-58351.html",
      "manifest_id": "1794182905550017006",
      "source_name": "ostorlab-research",
      "published_date": "2026-11-08"
    },
    {
      "title": "OpenAM Session Token Theft and SAML Bypass (CVE-2026-123551)",
      "source_url": "https://blog.ostorlab.co/openam-session-token-theft-saml-bypass-cve-2026-123551.html",
      "manifest_id": "1794144915020924335",
      "source_name": "ostorlab-research",
      "published_date": "2026-11-08"
    },
    {
      "title": "When Everyone Can Build, Who Wins? The Changing Rules of Cybersecurity Investing",
      "source_url": "https://jumpcap.com/insights/when-everyone-can-build-who-wins-the-changing-rules-of-cybersecurity-investing",
      "manifest_id": "1794167714847986749",
      "source_name": "jump-capital-insights",
      "published_date": "2026-11-08"
    },
    {
      "title": "Building a $250B Cybersecurity Giant | Nikesh Arora, Palo Alto Networks",
      "source_url": "https://davidsenra.com/episode/nikesh-arora",
      "manifest_id": "1794141619009920860",
      "source_name": "david-senra",
      "published_date": "2026-11-08"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1794182905550017006",
      "1794144915020924335",
      "1794167714847986749",
      "1794141619009920860"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1794182905550017006",
      "all": "for id in 1794182905550017006 1794144915020924335 1794167714847986749 1794141619009920860; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-11-09/flowise-9-8-flaw-exploited-in-the-wild/",
    "json": "https://hangingcontext.com/stories/2026-11-09/flowise-9-8-flaw-exploited-in-the-wild/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-11-09/flowise-9-8-flaw-exploited-in-the-wild/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-11-09T00/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-11-09/ai-supply-chain-attack-surface/",
      "headline": "The attack surface moved into the AI supply chain",
      "slug": "ai-supply-chain-attack-surface"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-09/agents-cross-authorization-lines/",
      "headline": "AI Agents Keep Crossing Lines They Were Never Given",
      "slug": "agents-cross-authorization-lines"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-11/reasoning-training-gets-cheaper/",
      "headline": "Better reasoning is getting cheaper to train",
      "slug": "reasoning-training-gets-cheaper"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-11/multilingual-ai-beyond-english/",
      "headline": "English is the outlier. The models are finally catching up",
      "slug": "multilingual-ai-beyond-english"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Ask what Synorb covers",
    "text": "The MCP tool synorb-stream-search answers questions like \"do you have this publisher?\" without using any Manifest allowance.",
    "cta": {
      "label": "Connect and ask",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-11-09/flowise-9-8-flaw-exploited-in-the-wild/"
  }
}