Loading story…
Researchers disclosed a chain of critical vulnerabilities in the Windmill workflow automation platform and its Nextcloud Flow integration that can lead to unauthenticated remote code execution. The most severe issue, tracked as CVE-2026-29059, is a path traversal flaw affecting Windmill v1.309.0 through v1.603.2 and Nextcloud Flow v1.0.0 through v1.2.2, allowing attackers to read arbitrary files, steal secrets and tokens, and potentially gain root-level code execution. In Nextcloud Flow deployments, the risk was amplified because a public unauthenticated jobs_u endpoint was exposed through the proxy, enabling attacks without logging in.
A second flaw, described as an authenticated SQL injection affecting Windmill v1.276.0 through v1.603.2, allowed users with limited access to exfiltrate database contents, escalate privileges from operator to super_admin, and execute code. The reported exploit chain also leveraged plaintext Windmill credentials stored by Nextcloud Flow, access to PostgreSQL data, and theft of the Nextcloud AppAPI secret to compromise the broader Nextcloud environment; in some cases, host escape was possible where the Docker socket was mounted. Windmill said it fixed the issues in v1.603.3 and v1.615.0, while Nextcloud Flow addressed the bundled vulnerable version in v1.3.0 before later being deprecated in favor of an official Windmill integration.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Following remediation, Nextcloud Flow was later deprecated and replaced with an official Windmill integration. This marked the retirement of the affected third-party integration after the disclosed security issues.
A detailed public report explained how the flaws could be chained from unauthenticated path traversal to credential theft, PostgreSQL access, AppAPI secret recovery, and full Nextcloud compromise. It also documented authenticated privilege escalation from operator to super_admin and subsequent code execution in vulnerable Windmill deployments.
Nextcloud Flow addressed the vulnerable embedded Windmill component in version v1.3.0, ending exposure for versions v1.0.0 through v1.2.2. The integration had been particularly risky because it proxied a public unauthenticated endpoint and stored Windmill credentials in plaintext.
Windmill released fixes for the reported issues, with the path traversal flaw fixed in v1.603.3 and later remediation also referenced in v1.615.0. The affected ranges included Windmill versions from v1.309.0 through v1.603.2 for CVE-2026-29059 and from v1.276.0 through v1.603.2 for the SQL injection issue.
On 2026-01-10, researcher Chocapikk disclosed multiple vulnerabilities affecting Windmill and its Nextcloud Flow integration, including unauthenticated path traversal CVE-2026-29059 and an authenticated SQL injection issue. The disclosure described paths to credential theft, privilege escalation, and remote code execution, with Nextcloud Flow deployments especially exposed through a public proxied endpoint.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcechocapikk.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **elttam** disclosed **six remote code execution vulnerabilities** in the **Flowise** AI agent and workflow platform, affecting versions **3.1.1** and **3.1.2**. The flaws could allow attackers to execute code on exposed Flowise servers, raising concerns for organizations using the platform to orchestrate AI workflows and integrations. Reporting on the issue also referenced Flowise-related local and container paths and endpoints tied to authentication, document processing, and custom function handling, including sensitive files such as `/proc/self/environ` and `/root/.flowise/database.sqlite`. Those details suggest attackers could pursue local file access and post-exploitation activity after initial compromise, adding to concerns around Flowise's recurring history of critical security advisories.
Sep 3, 2026
Flowise disclosed a critical remote code execution flaw, tracked as **`CVE-2026-56274`**, affecting versions before **`3.1.2`** in the Custom MCP Server feature. The vulnerability stems from multiple OS command injection paths in **`validateCommandFlags`** and **`validateArgsForLocalFileAccess`**, allowing attackers to configure a malicious MCP server and execute arbitrary commands on the Flowise host. The issue is rated **CVSS 9.9** and is remotely exploitable. Advisories describe three bypass techniques: an incomplete Docker argument blocklist that permits **`docker build`** with a remote URL, an **`npx`** blocklist bypass where **`--yes`** is allowed even though **`-y`** is blocked, and a Unix path validation weakness that lets paths beginning with **`//`** evade local file access checks for **`node`**. Exploitation requires any Flowise account role or API access with view and update permissions for chatflows. Organizations were urged to upgrade to **`Flowise 3.1.2`** or later, review MCP server configurations, and restrict chatflow management permissions.
Jun 29, 2026
Threat actors are actively exploiting **CVE-2025-59528**, a **CVSS 10.0** remote code execution flaw in the open-source AI platform **Flowise**. The bug affects Flowise versions through **3.0.5** and stems from the `CustomMCP` node unsafely passing user-controlled input into JavaScript execution, allowing attackers with an API token to run arbitrary code with full **Node.js** runtime privileges. Researchers said the issue can be triggered remotely via a crafted HTTP `POST` request without user interaction, leading to operating system command execution, filesystem access, sensitive data theft, and full system compromise. Security researchers observed in-the-wild exploitation originating from a single **Starlink IP address**, while warning that roughly **12,000 to 15,000** internet-exposed Flowise instances sharply expand the attack surface for opportunistic attacks. Flowise disclosed the vulnerability in 2025, credited researcher **Kim SooHyun**, and patched the flaw in **version 3.0.6**. The incident marks the third Flowise vulnerability reported as exploited in the wild after **CVE-2025-8943** and **CVE-2025-26319**, increasing pressure on organizations to upgrade immediately and limit public exposure of Flowise APIs.
Jun 29, 2026