Latest
  1. Dropbox agrees to buy Tigris Data for $350m to expand its AI infrastructure
  2. About 600,000 Nvidia H200 chips are stored in Hong Kong awaiting Chinese approval
  3. Anthropic’s compute costs rose to 58% of revenue in Q3, its IPO filing shows
  4. Greeter campaign uses unpatched Flowise servers to hide cloud credential theft
  5. Moonshot AI discussed leasing Blackwell capacity from European operators
  6. Anthropic has not fixed a Claude Dispatch flaw that can run commands on a user’s computer
  7. OpenAI sets out data centre policies to win local trust
  8. China blocks SoftBank’s $5.4 billion takeover of ABB’s robotics unit

Latest / Media, elections and online safety

IncidentMediaFrontierInternationalConfirmed

Greeter campaign uses unpatched Flowise servers to hide cloud credential theft

See how this story connects

Source: TechTarget

Researchers at Era Security described a campaign they named Greeter that targets unpatched Flowise AI servers through CVE-2024-58351, in versions before 2.1.4. The attack supplies its payload per request through overrideConfig.javascriptFunction, so the saved workflows and chat logs show only repeated “hello” messages while the server returns environment profiles and stolen credentials. Shodan found 4,372 Flowise instances on the public internet, 703 without authentication, and 46 of those running the vulnerable configuration.

Why it matters

Organisations running self-hosted Flowise must patch it themselves, because official support has ended and unpatched instances stay exposed.

When
5 Nov 2026
ID
WTA-N-2026-0734
Who
Era Security, Workday; Neta Roza
System
Flowise AI agent platform (self-hosted, versions before 2.1.4)
Operator
organisations running unpatched Flowise servers
Type
per-request code injection through CVE-2024-58351 hides credential theft and cloud reconnaissance behind repeated “hello” messages
Status
46 exposed instances ran the vulnerable configuration; Flowise reached end of life in August 2026; disclosed by Era Security, through TechTarget · Incident ledger

Summary written with AI by wheresthe.ai, from TechTarget. Checked against the source on 5 Nov 2026.

Read the original at TechTarget

Source copy: saved on 5 Nov 2026 to check this story and not republished, because the text belongs to its publisher. Also held by the Internet Archive.

Cite this story

WTA-N-2026-0734: “Greeter campaign uses unpatched Flowise servers to hide cloud credential theft.” wheresthe.ai, 5 Nov 2026. https://wheresthe.ai/d/intl-greeter-campaign-uses-unpatched-flowise-servers-to-hide-2026-11/ (source: TechTarget).

Spotted an error? Email [email protected].