Flowise Greeter Attack Shows How One OpenAI Builder Opens Your Whole Cloud
- Who should care: Teams running Flowise or any self-hosted AI agent builder that can reach cloud credentials, since the Flowise Greeter attack targets exactly that setup.
- What could go wrong: One chat endpoint with no login becomes a doorway into your AWS, Azure, or Google Cloud accounts.
- Do this: Patch Flowise, turn on authentication, and hunt for the IOCs below today.
- Worth remembering: Your chat logs can look perfectly polite while the server is being emptied.
Introduction
Someone kept saying “hello” to a chatbot. Thousands of times, 3.5 seconds apart. That is the Flowise Greeter attack. Each greeting carried a hidden command, and together they mapped the server, hunted for cloud keys, and tried to move in for good.
What Happened in the Flowise Greeter Attack?
Researchers at Era Security caught a Chinese-language exploitation framework, now called Greeter, hitting seven Flowise honeypots across four regions between July and October 2026. Flowise is a popular open-source tool for building AI agents and chatbots.
The Flowise Greeter attack abused CVE-2024-58351 (CVSS 9.8). The flaw lets a caller swap in their own JavaScript through the prediction API’s overrideConfig setting. Ostorlab has a technical breakdown of the bug. The saved chatflow never changed, and the chat history showed only “hello.”
Meanwhile, behind the scenes, more than 4,000 commands ran recon, probed cloud metadata services, searched for SSH keys and .env files, and set up fileless execution.
What’s the Impact?
A scan found 4,372 Flowise servers online. Of the 3,277 that revealed a version, 703 (21.5%) had no login at all. Another 46 matched the exact vulnerable setup Era used for its honeypots.
So far, no real victims are confirmed. Even so, the Flowise Greeter attack shows what an AI app with cloud roles hands over: everything those roles can touch. Attackers already go after AI infrastructure, as the Ray AI flaw on CISA’s must-patch list showed.
How to Avoid the Flowise Greeter Attack
- Upgrade Flowise to 3.1.4, or at least 2.1.4, which fixes CVE-2024-58351.
- Turn on authentication. Set
FLOWISE_USERNAMEandFLOWISE_PASSWORD, or create an admin account on 3.x. - Turn off override config on chatflows that don’t need it.
- Shrink the blast radius. Run Flowise as a non-root user, require IMDSv2, and lock down the Docker socket.
- Hunt, then rotate. Search logs for
overrideConfigwithjavascriptFunction, then rotate every secret the process could read.
Flowise Greeter Attack Indicators of Compromise (IOCs)
Era published host and request indicators for Greeter: the TOR exit node 185.246.188[.]74, a chatflow named ghsa-5cph-wvm9-45gj-poc, VP_ status markers in chat replies, polld-keeper and varrun-watcher processes, and cron and systemd persistence files. One overrideConfig hit alone is only a lead, since legit flows use it too. Several together are a problem.
Your AI Builder Has Your Cloud Keys. So Does Anyone Who Says Hello.
In practice, most teams set up AI agent tools fast and never ask what those tools could reach. Secure.com’s governed AI teammates test that gap first, then close it, while your team sets the rules.
- Red Teammate tests whether an exposed Flowise server can actually reach your cloud roles and secrets.
- Cloud Teammate flags over-scoped workload identities, open metadata access, and long-lived keys sitting in environment files.
- SOC Teammate hunts for Flowise Greeter attack IOCs across your fleet and builds the case, so analysts don’t have to grep logs by hand.
- AppSec Teammate tracks unpatched AI tools like Flowise and queues fixes with clear priority.
- Every consequential action waits for your approval, with a full audit trail.
Conclusion
The Flowise Greeter attack ran on an old, already fixed bug. Polite chat logs hid a full cloud credential hunt. Patch Flowise, put a login in front of it, and check what its process can reach before someone else does.
