Back to the CVE list
CVE-2026-58057

Vulnerability in Flowiseai

CVSS score

5.0

EPSS probability

%1.6

Risk score

0.1

Published

3 mo ago

OverviewPublic Exploits (3)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
CerberusMrXi/Flowise-CVE-2026-58057-exploit
GitHub

Flowise Windows RCE exploit for CVE-2026-58057. Bypasses environment variable validation via case-sensitive flaw. Uses node_options to inject arbitrary code through MCP stdio. Supports reverse shell, persistence, file upload, credential dumping. For authorized security testing only.

Public PoCSource updated: 26.07.2026 18:00:42
E
Flowise 3.1.3 - arbitrary code execution
Exploit-DB

Flowise 3.1.3 - arbitrary code execution

Exploit referenceSource updated: 07.07.2026 00:00:00
G
bikini/exploitarium/tree/main/flowise-mcp-env-case-bypass-poc
GitHub

https://github.com/bikini/exploitarium/tree/main/flowise-mcp-env-case-bypass-poc

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-58057"