CVE-2025-59434

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from other tenants via the Custom JavaScript Function node. This includes secrets such as OpenAI API keys, AWS credentials, Supabase tokens, and Google Cloud secrets — resulting in a full cross-tenant data exposure. This issue has been patched in the August 2025 Cloud-Hosted Flowise.

• CWE-200
• CWE-284

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22

Published

Sep 22, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59429FreePBX is an open source GUI for managing Asterisk. In vers…5.4
• CVE-2025-5943MicroDicom DICOM Viewer suffers from an out-of-bounds writ…8.8
• CVE-2025-59430Mesh Connect JS SDK contains JS libraries for integrating wi…8.2
• CVE-2025-59431MapServer is a system for developing web-based GIS applicati…9.8
• CVE-2025-59432SCRAM (Salted Challenge Response Authentication Mechanism) i…6.6
• CVE-2025-59433Conventional Changelog generates changelogs and release note…5.3
• CVE-2025-59436The ip (aka node-ip) package through 2.0.1 (in NPM) might al…3.2
• CVE-2025-59437The ip (aka node-ip) package through 2.0.1 (in NPM) might al…3.2
• CVE-2025-59438Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.5.3
• CVE-2025-59439An issue was discovered in Samsung Mobile Processor, Wearabl…7.5
• CVE-2025-5944The Element Pack Addons for Elementor plugin for WordPress i…5.4
• CVE-2025-59440An issue was discovered in USIM in Samsung Mobile Processor,…7.5