CVE-2024-58351
CVSS 9.8 CRITICAL: flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig… EPSS 0.7% (52nd percentile).
Vulnerabilities & Exploits
Era Security researchers documented Greeter attackers exploiting vulnerable Flowise deployments after finding publicly exposed Amazon DynamoDB instances; about 90% of nearly 3,000 Flowise deployments they scanned were unpatched against the critical code-injection flaw CVE-2024-58351.
In honeypots, the team saw attackers map privileges, hunt for credentials, abuse cloud metadata services across providers to expand access, and establish persistence. They also left fleeting, harmless-looking “hello” messages in logs, obscuring nearby activity and making defenders spend time searching for those indicators.
For teams running Flowise with cloud identities, fixing the vulnerable service alone does not establish whether credentials or persistence remain. Publicly exposed DynamoDB presents a separate risk: anyone could download or delete its data, regardless of Flowise.
1 source · Nov 11
CVSS 9.8 CRITICAL: flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig… EPSS 0.7% (52nd percentile).
Dark Reading
Attackers Say 'Hello' to a Different Scale of Cloud Attack
Researchers dubbed an attack chain "Greeter" after discovering that attackers deliberately covered their trail by leaving "hello" messages in logs.
originalPart of the PlainSec briefing for 2026-11-11
Every edition of this story: Greeter attackers use Flowise to pursue cloud access