Flowise honeypot logged credential queries and prompt injection
October 22: Sekoia details a late-August Flowise 2.2.8 honeypot that listed credentials and built an outbound HTTP chatflow, without proving production theft.
Sekoia’s Flowise 2.2.8 honeypot logged credential queries, prompt injection and an outbound workflow, without proof of stolen production secrets.
Sekoia said an attacker used a honeypot emulating Flowise 2.2.8 in late August 2026 to list chatflows and credential records, then tried prompt injection and a “System Status” chatflow with an outbound HTTP callback. The early session lasted about three minutes before pausing; prompts also sought Nightingale and Redis details from a simulated Asian iGaming environment. Sekoia calls it opportunistic cybercrime, not a named APT, and says the honeypot ran no real model and cannot prove secrets were stolen. GBHackers reports Sekoia said the activity did not demonstrate CVE-2024-31621, while Cyber Security News lists that CVE; GBHackers says attempts referenced CVE-2025-59528 and CVE-2026-41264. Findings were first shared in a private FLINT report on 7 September 2026.
- Honeypot emulated Flowise 2.2.8 and did not run a real model or system code.
- Attacker listed chatflows and credentials, then created a System Status HTTP workflow.
- Callback host 154.217.251.226 on port 19999 was published defanged.
- Chinese-language prompts sought vulnerability and lateral-movement guidance.
- Sekoia attributes the activity to opportunistic cybercrime, not a named APT.
- GBHackers: attempts referenced CVE-2025-59528 and CVE-2026-41264.
Timeline
dated events in the reporting · oldest first- Sep 7, 2026Sekoia shared findings in a private FLINT report. · GBHackers
What each outlet adds
beyond the shared facts- GBHackersSekoia denies CVE-2024-31621 was shown; names other CVEs and the callback host.
- Cyber Security NewsThree-minute opening burst, workflow changes, and a simulated Asian iGaming target.
Coverage
oldest first · one row per article · UTC- · 3d ago
GBHackersFirst report
Attacker probes Flowise honeypot for credentials and workflow hijacking
Sekoia’s emulated Flowise 2.2.8 captured credential queries and prompt injection, without proof of production theft.
- · 3d ago
Cyber Security News
Hacker attempts prompt injection on Flowise AI agent
Exposed Flowise honeypot shows attacker using AI agent for reconnaissance against other servers via prompt injection.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-31621 | An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component | 7.6 | 60% | PoC | |
| CVE-2025-59528 | Critical Unauthenticated RCE in Flowise AI Agent Builder | 10.0 | 86% | PoC ×3 | |
| CVE-2026-41264 | Flowise: The specific flaw exists within the run method of the CSV_Agents class. The issue results from the lack of proper sandboxing when… | 9.2 | 2% | PoC |