Flowise leaks your OAuth secrets unauthenticated, n8n hides SQL injection in column names

Keras has a path traversal bug that lets an attacker read or write files outside the intended directory by supplying crafted file paths to model loading or saving functions. If you host Keras-based ML services that accept user-supplied model files or paths, an attacker could use this to steal data or drop malicious files on the server. CVSS 8.1, so treat it seriously even though exploitation requires some user interaction or a reachable Keras endpoint.

Affected estate

ML engineers and platform teams running Keras 3.3.3-7 on Azure Linux 3.0, or anyone self-hosting Keras services that handle untrusted model paths

How to check

Run `tdnf list installed keras` or `pip show keras` to confirm the installed version.

Included because

path traversal; CVSS 8.1; common ML framework

Action

Update keras via `tdnf update keras` or `pip install --upgrade keras` depending on your deployment method.

Why it matters

An attacker who can supply file paths to Keras could read sensitive files or overwrite system files on your ML hosts.

Source

NVD

n8n's MySQL, PostgreSQL, and Microsoft SQL nodes don't properly escape identifier values (table names, column names) in workflow configurations. Any authenticated user with workflow creation permissions can inject arbitrary SQL through crafted identifiers, letting them run unauthorized queries, exfiltrate data, or corrupt your database. This is a classic SQL injection, just hiding in a spot you might not expect.

Affected estate

Teams running self-hosted n8n instances prior to version 2.4.0 that connect to MySQL, PostgreSQL, or Microsoft SQL databases

How to check

Check your n8n version in the admin panel or run `n8n --version`. Review workflows for any MySQL, PostgreSQL, or MSSQL node usage.

Included because

authenticated; SQL injection; CVSS 8.2; data integrity risk; common automation platform

Action

Upgrade n8n to 2.4.0 or later. Audit existing workflows for suspicious table or column names in database nodes.

Why it matters

Any user who can create workflows can run arbitrary SQL against your connected databases, putting all that data at risk.

Warp terminal running under WSL has an OS command injection bug in its URL-opening fallback. When wslview fails to open a URL, Warp falls back to the Windows command processor, and a malicious URL rendered in terminal output can inject arbitrary OS commands. The catch: the user has to click the link, and you have to be running Warp under WSL specifically. Still, CVSS 7.7, because a single click can mean full command execution.

Affected estate

Developers and engineers using Warp terminal under WSL, versions 0.2024.03.12.08.02.stable_01 through 0.2026.05.06.15.42.stable_01

How to check

Open Warp and check the version in Settings or run the version check command. Confirm whether the installation runs under WSL.

Included because

command injection; user interaction required; WSL-specific; CVSS 7.7

Action

Update Warp to 0.2026.05.06.15.42.stable_01 or later. Until patched, avoid clicking untrusted URLs rendered in terminal output.

Why it matters

Clicking a malicious link in terminal output can execute arbitrary commands on the Windows host, potentially compromising your workstation.

Source

Vendor advisory

Flowise versions 3.0.13 and earlier have a completely unauthenticated endpoint that hands back your full SSO configuration, including OAuth client secrets in cleartext, to anyone who knows your organization ID. An attacker can harvest credentials for Google, Microsoft/Azure, GitHub, and Auth0 integrations with a single GET request. No login required. This is bad.

Affected estate

Anyone running Flowise self-hosted or on FlowiseAI Cloud with SSO configured, versions 3.0.13 and earlier

How to check

Check your Flowise version in the admin UI or deployment config. Test whether `/api/v1/loginmethod?organizationId=<your-org-id>` returns SSO details without authentication.

Included because

unauthenticated; internet-facing; credential exposure; CVSS 7.5; no exploit complexity

Action

Upgrade to Flowise 3.1.0 or later. Rotate all OAuth client secrets exposed through this endpoint. Review access logs for any prior unauthenticated hits to `/api/v1/loginmethod`.

Why it matters

Your OAuth secrets are exposed to anyone on the internet, giving attackers the keys to impersonate your SSO integrations.