Era Security Caught a Framework That Sends Only the Word Hello to Flowise and Runs Shell Commands Through It. 703 of 3,277 Exposed Instances Have No Login, and Flowise Support Has Ended.
If you run Flowise, find every copy today, turn on authentication, and take it off the open internet, because Era Security reports a framework it calls Greeter has been running commands on Flowise honeypots since July by abusing CVE-2024-58351. Era published on November 3, 2026, and SecurityWeek and TechTarget picked it up. Era found it on honeypots only. Nobody has reported a real victim.
What Era saw
Era ran seven Flowise honeypots across four regions from July to October 2026. They ran Flowise 1.8.2 with the username and password settings left undefined, so there was no login. Over that time the honeypots stored 4,972 user messages, every one of them "hello", and Era reconstructed more than 4,000 commands from them.
The trick is in the request. The attacker posts "hello" to a chatflow's prediction endpoint with an overrideConfig object that carries a javascriptFunction key. That key replaces the code of a Custom JavaScript Function node for that one request. The injected code is never saved, so the chatflow stored in the database looks normal while each "hello" carries a fresh set of instructions. Era says the reconstructed payloads call shell commands through child_process.execSync.
The flaw is CVE-2024-58351, a code injection rated 9.8 that affects Flowise before version 2.1.4.
What the framework does, as reported
- Requests arrive 3.5 seconds apart, and responses include a "vp-alive" marker with an eight-character hex nonce.
- After a 16-minute gap it runs the id command, then a single payload that returns a 1,048,506-character response chaining 19 commands, with Chinese-language section labels and a random hex marker. It covers users, hostname, kernel, processes, listening ports, network interfaces, cron jobs, container details, mounts, routes and file capabilities.
- It probes the cloud metadata services of AWS, Azure and Google Cloud, checks Linux capabilities and sudo rights, and looks for .env files, client certificates, SSH keys, SQLite files and the Flowise encryption key at /root/.flowise/encryption.key.
- It tries to plant persistence under names that imitate system services. In Era's honeypot the attempt failed.
- It sends back environment variables, login history and authentication logs, and it checks whether fileless, memory-only execution is possible.
- The payload crashed after initialization in Era's honeypot. The honeypot's cloud credentials were fake, and Era did not see a successful takeover of a cloud account.
TechTarget compares the cloud path to Sysdig's 2023 ScarletEel work. Era's CEO is quoted saying stolen instance-role credentials do not automatically grant administrative access.
The exposure numbers, with their denominators
Era found 4,372 unique Flowise instances on the internet through Shodan. Of those, 3,277 reported a recognizable version, and 703 of the 3,277 (21.5 percent) had no authentication. Forty-six instances matched the same vulnerable conditions as the honeypots. That is 6.5 percent of the 703 unauthenticated hosts, and 1.4 percent of all 3,277 versioned hosts. Era's text and table use different denominators, so we give both. These are version-based estimates, not confirmed compromises.
The same scan counts far larger exposures to other Flowise flaws. Era lists 3,254 of the 3,277 hosts (99.3 percent) as exposed to CVE-2026-69255, a CSV agent code injection, and 2,924 (89.2 percent) to CVE-2026-46442, a sandbox escape. Greeter's own flaw is the smallest group on the list. That suggests a version-matched scanner has plenty of other doors, and we cannot tell from the report how many of them are open on any given host.
Support has ended
TechTarget reports Flowise's official end of life fell in August 2026. It quotes a Workday spokesperson as saying the platform "was retired on August 31, 2026", about a year after Workday acquired it, and says the repository was archived. The final community release was 3.1.4. TechTarget does not say whether 3.1.4 contains the CVE-2024-58351 fix, and Era does not name a fixed version. If you run a fork or a pinned old build, there may be nobody left to patch it.
What to do
- Inventory Flowise, including forks and copies bundled in other tools. The scan found it by the title "Flowise", so it is easy to find from outside.
- Require authentication and keep the service off the internet. Flowise listens on port 3000 by default.
- Run it as a non-root user, keep the Docker socket out of reach, drop Linux capabilities, and give the workload its own narrow cloud role. Require IMDSv2. Era notes IMDSv2 does not contain arbitrary code execution, it only raises the bar for stealing metadata tokens.
- Avoid long-lived credentials in files and environment variables on the host.
- After any suspected compromise, contain the application and every identity it could reach.
What to hunt for
Era lists these host strings. Files named polld-keeper followed by eight hex characters, and varrun-watcher followed by eight hex characters. Cron files named syslog-cronrun followed by eight hex characters under /etc/cron.d, and systemd units named taskd-sysrun followed by eight hex characters. The configuration hash 07f8464533b3446e918feff1ea14c4ae. Output strings beginning vp-alive, and markers starting VP_ such as VP_DOCKER, VP_MEMFD, VP_W_OK and VP_INIT_OK. In chatflow data, an overrideConfig containing a javascriptFunction key, and the string ghsa-5cph-wvm9-45gj-poc.
What our own edge saw
Since October 9 our edge blocked 12 requests from 4 addresses on Flowise paths, all on October 9 and October 21 and all from one network. The paths were the unauthenticated custom MCP loader and the custom function node, which are different Flowise bugs. We saw none on the prediction path Greeter uses, no canary or origin-honeypot hits, and no Flowise decoy is in place. The user agents claimed to be Googlebot and PanguBot, which is a claim and not a fact. This is recon against other Flowise flaws, not evidence of Greeter in our data.
Indicators
Era lists one network indicator, 185.246.188[.]74, and calls it a Tor exit node. We already carry that address as a Tor exit at confidence 40 from a third-party feed. A Tor exit is shared by every user of the network, so we did not raise it or attribute it to an actor. There are no file hashes, no domains and no command-and-control addresses in the report, so nothing was added to the feed.
Limits
We read Era's write-up, TechTarget and SecurityWeek. We did not run the exploit or read the Flowise advisory, and we cannot say which Flowise version fixes the flaw. Era describes the framework as Chinese-language because of the section labels and names no actor. Attribution would need more than that. Whether an automated agent is behind it is unconfirmed.
Five percent of this is wrong somewhere. It always is. A fixed-version number from Flowise's advisory is the detail we would most like to add.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.