Attacker probes Flowise honeypot for credentials and workflow hijacking
Original title: Attackers Target Flowise AI Agents With Credential Theft, Prompt Injection and Workflow Hijacking
Sekoia’s emulated Flowise 2.2.8 captured credential queries and prompt injection, without proof of production theft.
Sekoia said an attacker used a honeypot emulating Flowise 2.2.8 in late August 2026 to list chatflows and credential records, then tried prompt injection and a “System Status” chatflow with an outbound HTTP callback. Sekoia explicitly says the activity did not demonstrate CVE-2024-31621. Prompts also requested analysis of Nightingale and Redis details from a real iGaming environment. Sekoia calls it opportunistic cybercrime, not a named APT, and says the honeypot cannot prove secrets were stolen.
Unconfirmed: Sekoia does not confirm production secret theft, a successful intrusion of the iGaming target, or attribution to a named group.
- The findings were first shared in a private FLINT report on 7 September 2026.
- Attempts referenced CVE-2025-59528 and CVE-2026-41264, among other flaws.
- Researchers listed callback host 154.217.251.226 on port 19999, published defanged.
- Chinese-language prompts sought vulnerability and lateral-movement guidance.
- The honeypot did not run a real model or system code.
Impact: attempted credential access and agent misuse on a honeypot
| Product | Affected |
|---|---|
| Flowise | honeypot emulated 2.2.8 |
- 1.Inventory exposed Flowise deployments and restrict administrative and credential APIs.
- 2.Update to versions that address applicable vulnerabilities.
- 3.Limit agent tools, RAG access, and outbound network connections to what each workflow needs.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-59528 | Critical Unauthenticated RCE in Flowise AI Agent Builder | 10.0 | 86% | PoC ×3 | |
| CVE-2026-41264 | Flowise: The specific flaw exists within the run method of the CSV_Agents class. The issue results from the lack of proper sandboxing when… | 9.2 | 2% | PoC |
From the original article
3 min read at gbhackers.com
An attacker used an exposed Flowise AI orchestration server to enumerate workflows, harvest credentials, and try to turn its language-model agent into an offensive analysis assistant. Sekoia says the findings were first shared in a private FLINT report on 7 September 2026. The honeypot emulated Flowise 2.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.