CVE-2024-58351
CVSS 9.8 CRITICAL: flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig… EPSS 0.7% (52nd percentile).
Vulnerabilities · 1 day ago
Era Security researchers documented Greeter attackers exploiting vulnerable Flowise deployments after finding publicly exposed Amazon DynamoDB instances; about 90% of nearly 3,000 Flowise deployments they scanned were unpatched against the critical code-injection flaw CVE-2024-58351.
In honeypots, the team saw attackers map privileges, hunt for credentials, abuse cloud metadata services across providers to expand access, and establish persistence. They also left fleeting, harmless-looking “hello” messages in logs, obscuring nearby activity and making defenders spend time searching for those indicators.
For teams running Flowise with cloud identities, fixing the vulnerable service alone does not establish whether credentials or persistence remain. Publicly exposed DynamoDB presents a separate risk: anyone could download or delete its data, regardless of Flowise.
CVSS 9.8 CRITICAL: flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig… EPSS 0.7% (52nd percentile).
1 source covering this story
Attackers Say 'Hello' to a Different Scale of Cloud Attack
Researchers dubbed an attack chain "Greeter" after discovering that attackers deliberately covered their trail by leaving "hello" messages in logs.
Part of the PlainSec briefing for 2026-11-12