The malicious content was delivered in the request configuration rather than saved in the chatbot flow. A response archive that stored only the user message would show repeated greetings, while the transient overrideConfig.javascriptFunction executed scripts in the running Flowise process. The recovered payload stages probed local processes, cloud metadata…
Inspect the ClaimsCase · DiggingBeagle record
Greeter hid Flowise host probes behind thousands of hello messages
Era Security observed repeated Flowise API requests whose stored chat text concealed transient code execution.
Public disclosure: Nov 3, 2026
Scope
Flowise overrideConfig exploitation observed in dedicated November 2026 honeypots, with an older underlying vulnerability and separate external exposure estimates.
Assessment profile
Assessment method- Setting
- controlled live
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Era Security observed attacker-origin overrideConfig calls in purpose-built Flowise honeypots and separately estimated internet exposure. The external hosts are not verified compromises. An impact band remains unassigned because the available evidence does not establish a comparable severity score or verified numerical loss for this assessment.
Assessed Nov 8, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-FLOWISE-GREETER-HELLO-OVERRIDE-01 · CLM-FLOWISE-GREETER-HELLO-OVERRIDE-02 · Era Security: You Had Me at Hello · Flowise overrideConfig security advisory
At a glance
Auditing only the stored model conversation misses executable request-side overrides. The census numbers are potential exposures, not a victim count.
Read the implicationsEra Security used intentionally exposed Flowise 1.8.2 honeypots, so their requests establish attacker behavior against the sensors, not confirmed compromise of the forty-six other apparently vulnerable hosts. The campaign did not establish that a separate AI model selected each command.
Limits and uncertaintyFull account
The malicious content was delivered in the request configuration rather than saved in the chatbot flow. A response archive that stored only the user message would show repeated greetings, while the transient overrideConfig.javascriptFunction executed scripts in the running Flowise process. The recovered payload stages probed local processes, cloud metadata and stored credentials.
Era Security used intentionally exposed Flowise 1.8.2 honeypots, so their requests establish attacker behavior against the sensors, not confirmed compromise of the forty-six other apparently vulnerable hosts. The campaign did not establish that a separate AI model selected each command.
The observation and the exposure estimate have different denominators. Era Security saw 4,972 repeated hello messages on its controlled Flowise sensors, where request-local overrideConfig values carried the executable JavaScript and the stored conversation showed only the benign string. The investigators separately enumerated 46 apparently vulnerable public services. Those were candidate exposures, not verified victims. Logging the entire prediction request, including overrides, is necessary to reconstruct the attack route without assuming the model generated the commands.
Mechanism and trust boundary
- 01
Send repeated POST prediction requests to an unauthenticated Flowise chatflow.
- 02
Set request-local overrideConfig JavaScript while leaving the persisted flow unchanged.
- 03
Collect or probe host resources in the runtime response.
Claims & evidence
CLM-FLOWISE-GREETER-HELLO-OVERRIDE-01Era Security recorded 4,972 chat messages containing hello while an attack framework supplied execution-bearing overrides and collected host or credential metadata.supported
Basis: reported finding
- supportsEra Security: You Had Me at Helloprimary disclosure
Opening investigation; Greeter attack flow and stored user messages
CLM-FLOWISE-GREETER-HELLO-OVERRIDE-02In a census of version-identifiable Flowise services, the investigators found 703 unauthenticated instances and 46 meeting the reported conditions for this older overrideConfig flaw.supported
Basis: reported finding
- supportsEra Security: You Had Me at Helloprimary disclosure
Internet exposure: versions, authentication and potentially affected hosts
Implications
Auditing only the stored model conversation misses executable request-side overrides. The census numbers are potential exposures, not a victim count.
Controls and mitigations
- Patch the old Flowise overrideConfig execution route and remove unauthenticated public access to affected chatflows.
- Retain request-level API parameters and execution receipts during investigations; persisted chatflow definitions and message text alone conceal transient JavaScript overrides.
Unknowns and contradictions
- Era Security used intentionally exposed Flowise 1.8.2 honeypots, so their requests establish attacker behavior against the sensors, not confirmed compromise of the forty-six other apparently vulnerable hosts. The campaign did not establish that a separate AI model selected each command.
Sources and citation
Material revision history
- Nov 8, 2026 · Canonical change recorded · new in release · revision 229