ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-58434

Flowise is a drag & drop user interface to build a customized large language model flow.

Published Sep 12, 2025 · catalog updated Sep 15, 2025 · Cloudflare Flowise

Last checked Oct 25, 2026. A connected source was read within the last 7 days.

Check this week

CVE-2025-58434 is not in CISA KEV. FIRST estimates a 50.54% chance of exploitation in the next 30 days. Check whether you run Cloudflare Flowise.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Critical9.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
50.54%
Remediation
Advisory link
Affected products
vendor FlowiseAI Flowise ≤ 3.0.5

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the endpoint in Flowise returns sensitive information including a valid password reset without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud service ( ) and self-hosted/local Flowise deployments that expose the same API. Commit 9e178d68873eb876073846433a596590d3d9c863 in version 3.0.6 secures pas

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor FlowiseAI Flowise ≤ 3.0.5≤ 3.0.5

How to fix CVE-2025-58434

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2025-58434 is not in CISA KEV. FIRST estimates a 50.54% chance of exploitation in the next 30 days. Check whether you run Cloudflare Flowise.

Which versions are affected?

Compare what you have installed with FlowiseAI Flowise ≤ 3.0.5 ≤ 3.0.5. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 50.54%. There is no CISA KEV listing. A public exploit reference is linked in Sources. That is not the same as confirmed exploitation. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 12, 2025 · EUVD

    Detected

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the endpoint in Flowise returns sensitive information including a valid password reset without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). T

  2. Sep 15, 2025 · EUVD

    Updated

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the endpoint in Flowise returns sensitive information including a valid password reset without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). T

Sources

  • Cloudflare WAF rulesVendor advisoryCVE-2025-58434

    CVE-2025-58434 is named in a Cloudflare managed-rules release. The default action recorded for those rules is Block.

    developers.cloudflare.com
  • CVE.orgVulnerability recordCVE-2025-58434

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-58434

    30-day exploitation probability 50.54%

    first.org
  • EUVDVulnerability recordEUVD-2025-29069

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the endpoint in Flowise returns sensitive information including a valid password reset without authentication or verification. This enables any attacker to gener

    euvd.enisa.europa.eu
  • Exploit DatabasePublic exploit reference52557

    Public exploit archive reference. This is not confirmation of exploitation. The exploit body is not stored here.

    exploit-db.com

References

Freshness

Last verified in this catalog Oct 23, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Cloudflare WAF rulesOct 25, 2026
  • Exploit DatabaseOct 24, 2026
  • FIRST EPSSOct 23, 2026
  • CVE.orgOct 22, 2026
  • EUVDOct 22, 2026