# Threat actor abuses Flowise GenAI orchestration platform (CVE-2025-59528, CVE-2026-41264, CVE-2024-31621 class) and weaponizes its LLM agent for offensive reconnaissance

> Sekoia's Flowise v2.2.8 honeypot captured a Chinese-speaking actor fingerprinting the service, stealing stored credentials through unauthenticated API access, injecting an outbound HTTP callback chatflow, and prompt-injecting the LLM agent to analyze third-party infrastructure (Nightingale/N9E and Redis tied to an iGaming platform). Attribution is unconfirmed and no malware was identified.

- **Published:** 2026-10-19T08:15:05Z
- **Last reviewed:** 2026-10-19T08:15:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3865
- **ID:** TL-2026-3865
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-59528, CVE-2026-41264, CVE-2024-31621

## Description

Sekoia's Threat Detection & Research team published a honeypot analysis on 2026-10-19 of an attack against an internet-exposed Flowise instance (v2.2.8, hosted in Japan) observed in late August 2026. The session ran in six phases. In P1 (about 3 minutes) the actor fingerprinted the service via /api/v1/ping and /api/v1/version, enumerated /api/v1/chatflows and /api/v1/credentials, and read stored credentials with GET /credentials/{uuid}; the credential was a canary token that raised an alert. After roughly 2+ hours of inactivity (P2), the actor returned for in-depth reconnaissance, API fuzzing across route variants and inference probing (P3), then attempted workflow manipulation (P4): creating a chatflow named 'System Status' containing an HTTP callback node to hxxp://154.217.251.226:19999/flowise-hb and trying to modify 'Customer Support v2'. In P5 the actor used prompt injection, jailbreaks, system-prompt extraction attempts and multi-turn memory poisoning (session ID 'tame-session-001') to turn the honeypot's LLM agent into an offensive analysis assistant. Prompts asked it to query the RAG store for financial data, to assess a Redis server holding Nightingale (n9e) metadata keys, and to list known unauthorized-access vulnerabilities, default credentials and API exploitation paths for Nightingale v6, with answers requested in Chinese. In P6 the callback endpoint was polled periodically (about every 10 minutes).

Sekoia states the actor primarily used legitimate Flowise functionality and unauthenticated API access rather than exploiting software vulnerabilities; CVE-2025-59528, CVE-2026-41264 and CVE-2024-31621 are referenced as behavioral matches, not confirmed exploitation in this session. CVE-2025-59528 (CustomMCP node, convertToValidJSONString passes user input to Function(); Flowise 3.0.5, fixed in 3.0.6, CVSS 10.0, unauthenticated RCE) has seen active exploitation reported since April 2026. CVE-2026-41264 (CSV Agent node executes an LLM-generated Python script without sandboxing, reachable by prompt injection; fixed in 3.1.0, CVSS 9.8) and CVE-2024-31621 (authentication bypass on api/v1 in Flowise through 1.6.5; NVD CVSS 7.6, CWE-94) complete the relevant exposure set.

The actor's targets were an exposed Nightingale (N9E) monitoring system and an unsecured Redis server caching n9e metadata for a 'playz-prod' iGaming cluster in Asia (domains 98br.org, 98br.game, gr99.top, 11kk.co). Linguistic indicators (fluent Mandarin, gambling slang) point to a Chinese-speaking, financially motivated actor. Sekoia notes only victimology overlap, not a behavioral link, with Earth Berberoka/GamblingPuppet and Operation Dragon Castling. Severity is analyst-assigned (no CVSS for the campaign itself).

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1552 Unsecured Credentials
- T1213 Data from Information Repositories
- T1071.001 Web Protocols
- T1496 Resource Hijacking

## Sources

- [A honeypot's tale: Deconstructing an attack on GenAI infrastructure (Sekoia TDR)](https://www.sekoia.com/blog/a-honeypots-tale-deconstructing-an-attack-on-genai-infrastructure)
- [NVD - CVE-2025-59528](https://nvd.nist.gov/vuln/detail/CVE-2025-59528)
- [NVD - CVE-2026-41264](https://nvd.nist.gov/vuln/detail/cve-2026-41264)
- [NVD - CVE-2024-31621](https://nvd.nist.gov/vuln/detail/CVE-2024-31621)
- [Flowise GitHub Security Advisory GHSA-3gcm-f6qx-ff7p (CustomMCP RCE)](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p)
- [Flowise GitHub Security Advisory GHSA-3hjv-c53m-58jj (CSV Agent RCE)](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3hjv-c53m-58jj)
- [Tenable Research Advisory TRA-2024-33: Flowise Authentication Bypass](https://tenable.com/security/research/tra-2024-33)
- [Flowise 1.6.5 - Authentication Bypass CVE-2024-31621 (Exploit-DB 52001)](https://www.exploit-db.com/exploits/52001)
- [Rapid7 module: flowise_auth_rce_cve_2026_41264](https://www.rapid7.com/db/modules/exploit_multi/http/flowise_auth_rce_cve_2026_41264/)
- [Aviatrix Threat Research: Flowise AI 2025 Remote Code Execution Vulnerability](https://aviatrix.ai/threat-research-center/flowise-ai-2025-remote-code-execution-vulnerability)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3865