Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

CVE-2026-52098: unauthenticated RCE in Flowise via the /api/v1/prediction/<flowId> endpoint

AIR-2026-0238 AIR record · 2026-09-flowise-prediction-endpoint-rce
Open in dashboard About
From the supporting source
An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpointcveawg.mitre.org
The record
Disclosed
2026-09-10
Vendor
FlowiseAI
Product
Flowise
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target — agent framework endpoint RCE; no model decision
Attack surface
Agent framework
Autonomy level
Assistant
Initial vector
Unauthenticated network request
Impact type
Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0055 – Unsecured Credentials
NIST AI RMF
GOVERN 6.1
EU AI Act
Article 13
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool misuse
Mitigation
Apply least-privilege principle; Regular policy audits.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Flowise 3.1.2 and earlier
Capability abused
flow_executioncode_execution
Taxonomy & references
OWASP ASI05 Unexpected Code Execution (RCE)CVE-2026-52098remote_code_executionunauthenticatedprediction_endpointagent_framework
Curator notes
CVSS 9.8. Published 2026-09-10 (CVE Brief lists Sep 9). MITRE record is terse (references only). Distinct mechanism from earlier Flowise records in the corpus (CVE-2025-59528 CustomMCP, CVE-2026-69255 CSV Agent) - kept separate per the unit-of-record rule. PoC/disclosure; no real victim.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-52098: unauthenticated RCE in Flowise via the /api/v1/prediction/<flowId> endpoint". AIR, AIR-2026-0238. https://agentincident.vercel.app/i/AIR-2026-0238/ (accessed 2026-10-19).