{
 "id": "AIR-2024-0154",
 "slug": "cve-2024-36421-flowise-cors-misconfiguration-vulnerability",
 "title": "CVE-2024-36421: Flowise CORS misconfiguration vulnerability",
 "summary": "Flowise version 1.4.3 contains a CORS misconfiguration that allows arbitrary origins to connect and make requests to the application. This can lead to information theft and can be chained with path injection to read server files.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Flowise"
 ],
 "incident_date": "2024-08-05",
 "incident_date_precision": "day",
 "first_reported": "2024-07-01",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36421",
   "publisher": "NVD",
   "title": "CVE-2024-36421: Flowise is a drag & drop user interface to build a customized large language model flow.",
   "published_at": "2024-07-01"
  },
  {
   "url": "https://github.com/advisories/GHSA-66f2-xxgm-f6xp",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2024-36421: Flowise Cors Misconfiguration in packages/server/src/index.ts",
   "published_at": "2024-08-05"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2024-36421",
  "cors",
  "flowise"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}