Threat reportVulnerabilityTL-2026-3865
Threat actor abuses Flowise GenAI orchestration platform (CVE-2025-59528, CVE-2026-41264, CVE-2024-31621 class) and weaponizes its LLM agent for offensive reconnaissance
Threat actor abuses Flowise GenAI orchestration platform (TL-2026-3865) is a high-severity software vulnerability, first published 2026-10-19. It has no confirmed attribution, affects FlowiseAI Flowise, references 3 CVEs (CVE-2025-59528, CVE-2026-41264, CVE-2024-31621), maps to 6 MITRE ATT&CK techniques (T1071.001, T1190, T1213), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3865
- Threat ID
- TL-2026-3865
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- online gambling igaming, ai genai infrastructure
- Target regions
- hong kong, taiwan, singapore, brazil, south korea, japan
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Threat actor abuses Flowise GenAI orchestration platform
Malware and tooling: Flowise
How Threat actor abuses Flowise GenAI orchestration platform works
Sekoia's Flowise v2.2.8 honeypot captured a Chinese-speaking actor fingerprinting the service, stealing stored credentials through unauthenticated API access, injecting an outbound HTTP callback chatflow, and prompt-injecting the LLM agent to analyze third-party infrastructure (Nightingale/N9E and Redis tied to an iGaming platform). Attribution is unconfirmed and no malware was identified.
Sekoia's Threat Detection & Research team published a honeypot analysis on 2026-10-19 of an attack against an internet-exposed Flowise instance (v2.2.8, hosted in Japan) observed in late August 2026. The session ran in six phases. In P1 (about 3 minutes) the actor fingerprinted the service via /api/v1/ping and /api/v1/version, enumerated /api/v1/chatflows and /api/v1/credentials, and read stored credentials with GET /credentials/{uuid}; the credential was a canary token that raised an alert. After roughly 2+ hours of inactivity (P2), the actor returned for in-depth reconnaissance, API fuzzing across route variants and inference probing (P3), then attempted workflow manipulation (P4): creating a chatflow named 'System Status' containing an HTTP callback node to hxxp://154.217.251.226:19999/flowise-hb and trying to modify 'Customer Support v2'. In P5 the actor used prompt injection, jailbreaks, system-prompt extraction attempts and multi-turn memory poisoning (session ID 'tame-session-001') to turn the honeypot's LLM agent into an offensive analysis assistant. Prompts asked it to query the RAG store for financial data, to assess a Redis server holding Nightingale (n9e) metadata keys, and to list known unauthorized-access vulnerabilities, default credentials and API exploitation paths for Nightingale v6, with answers requested in Chinese. In P6 the callback endpoint was polled periodically (about every 10 minutes).
Sekoia states the actor primarily used legitimate Flowise functionality and unauthenticated API access rather than exploiting software vulnerabilities; CVE-2025-59528, CVE-2026-41264 and CVE-2024-31621 are referenced as behavioral matches, not confirmed exploitation in this session. CVE-2025-59528 (CustomMCP node, convertToValidJSONString passes user input to Function(); Flowise 3.0.5, fixed in 3.0.6, CVSS 10.0, unauthenticated RCE) has seen active exploitation reported since April 2026. CVE-2026-41264 (CSV Agent node executes an LLM-generated Python script without sandboxing, reachable by prompt injection; fixed in 3.1.0, CVSS 9.8) and CVE-2024-31621 (authentication bypass on api/v1 in Flowise through 1.6.5; NVD CVSS 7.6, CWE-94) complete the relevant exposure set.
The actor's targets were an exposed Nightingale (N9E) monitoring system and an unsecured Redis server caching n9e metadata for a 'playz-prod' iGaming cluster in Asia (domains 98br.org, 98br.game, gr99.top, 11kk.co). Linguistic indicators (fluent Mandarin, gambling slang) point to a Chinese-speaking, financially motivated actor. Sekoia notes only victimology overlap, not a behavioral link, with Earth Berberoka/GamblingPuppet and Operation Dragon Castling. Severity is analyst-assigned (no CVSS for the campaign itself).
MITRE ATT&CK techniques used in TL-2026-3865
Command and Control
Initial Access
T1190 Exploit Public-Facing Application
Collection
T1213 Data from Information Repositories
Impact
Credential Access
Reconnaissance
Affected products and versions in Threat actor abuses Flowise GenAI orchestration platform
- FlowiseAI — Flowise
Vulnerable versions: through 1.6.5 (CVE-2024-31621); 3.0.5 (CVE-2025-59528); before 3.1.0 (CVE-2026-41264); 2.2.8 honeypot instance
Fixed in: 1.6.6+ (CVE-2024-31621); 3.0.6 (CVE-2025-59528); 3.1.0 (CVE-2026-41264) - Nightingale (N9E) — Nightingale monitoring system v6
Vulnerable versions: internet-exposed instances targeted via LLM-assisted recon - Redis — Redis (unauthenticated, exposed instances)
Vulnerable versions: unsecured instances caching n9e metadata
Remediation for Threat actor abuses Flowise GenAI orchestration platform
Patches
- Upgrade Flowise to 3.0.6 or later for CVE-2025-59528
- Upgrade Flowise to 3.1.0 or later for CVE-2026-41264
- Upgrade Flowise beyond 1.6.5 (1.6.6+) for CVE-2024-31621
Immediate actions
- Block 154.217.251.226 and outbound traffic to port 19999 /flowise-hb at the perimeter
- Rotate every credential stored in Flowise and any API keys reachable from exposed instances
- Audit chatflows for unexpected HTTP callback nodes (e.g. 'System Status') and review outbound requests from the Flowise host
Workarounds
- Place Flowise behind a VPN or authenticating reverse proxy
- Disable or remove CustomMCP and CSV Agent nodes where not required
- Secure Redis and Nightingale (N9E) instances so they are not exposed without authentication
Longer-term hardening
- Require authentication and strict permission boundaries on all Flowise API routes; do not expose Flowise to the internet
- Restrict network egress from AI orchestration platforms to an allowlist
- Apply prompt-injection and agent-abuse guardrails; secure RAG pipelines and limit data stores reachable by agents
- Place canary credentials in AI orchestration platforms to detect credential theft
CVEs associated with Threat actor abuses Flowise GenAI orchestration platform
Weaknesses (CWE) in Threat actor abuses Flowise GenAI orchestration platform
Timeline of Threat actor abuses Flowise GenAI orchestration platform
- CVE-2024-31621 (Flowise api/v1 authentication bypass, through 1.6.5) published in NVD; public exploit later listed as Exploit-DB 52001.
- CVE-2025-59528 (Flowise CustomMCP node unauthenticated RCE, CVSS 10.0) disclosed; fixed in Flowise 3.0.6.
- Active exploitation of CVE-2025-59528 reported in the wild, with over 12,000 exposed Flowise instances noted.
- CVE-2026-41264 (Flowise CSV Agent prompt-injection to Python RCE, CVSS 9.8) published; fixed in Flowise 3.1.0.
- After 2+ hours of inactivity (date approximate), actor returns for API fuzzing, creates the 'System Status' callback chatflow to port 19999, attempts prompt injection against the LLM agent targeting Nightingale and Redis, and polls the callback about every 10 minutes.
- Late August 2026 (exact day not stated in source; date approximate): actor fingerprints the Sekoia Flowise 2.2.8 honeypot, enumerates chatflows and credentials, and reads a canary credential within about 3 minutes.
- Sekoia TDR publishes 'A honeypot's tale: Deconstructing an attack on GenAI infrastructure'.
Sources cited for Threat actor abuses Flowise GenAI orchestration platform
- A honeypot's tale: Deconstructing an attack on GenAI infrastructure (Sekoia TDR)
- NVD - CVE-2025-59528
- NVD - CVE-2026-41264
- NVD - CVE-2024-31621
- Flowise GitHub Security Advisory GHSA-3gcm-f6qx-ff7p (CustomMCP RCE)
- Flowise GitHub Security Advisory GHSA-3hjv-c53m-58jj (CSV Agent RCE)
- Tenable Research Advisory TRA-2024-33: Flowise Authentication Bypass
- Flowise 1.6.5 - Authentication Bypass CVE-2024-31621 (Exploit-DB 52001)
- Rapid7 module: flowise_auth_rce_cve_2026_41264
- Aviatrix Threat Research: Flowise AI 2025 Remote Code Execution Vulnerability
Detection coverage for TL-2026-3865
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3865 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.