Critical severity9.6NVD Advisory· Published Sep 22, 2025· Updated Apr 15, 2026

CVE-2025-59434

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from other tenants via the Custom JavaScript Function node. This includes secrets such as OpenAI API keys, AWS credentials, Supabase tokens, and Google Cloud secrets — resulting in a full cross-tenant data exposure. This issue has been patched in the August 2025 Cloud-Hosted Flowise.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Flowiseai/Flowisellm-fuzzy
Range: < August 2025 Cloud-Hosted

Patches

Vulnerability mechanics

References

github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22nvd

News mentions

No linked articles in our index yet.

cvss	0.624
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000