Flowise is archived, and its six September advisories will never get an official fix. What self-hosters can do

Description and use

Self-hosted Flowise users face critical and high‑severity vulnerabilities that remain unpatched. Pin to 3.1.4, enforce SSO restrictions, block /admin/queues, hide port 3000, and plan migration to maintained alternatives.

Problem

Self-hosted Flowise users face unpatched critical and high‑severity security advisories with no official fix.

Outcome

By pinning to 3.1.4 and applying the listed mitigations, users can reduce exposure to the six unpatched advisories while planning a migration to a maintained alternative.

Workflow

• 1. Pin to Flowise 3.1.4 (e.g., docker run flowiseai/flowise:3.1.4).
• 2. Configure SSO to use only verified‑email providers and disable unverified Auth0 connections.
• 3. Restrict SSO to your domains and disable password login while SSO is active.
• 4. Cancel any stale invitations.
• 5. Block /admin/queues via proxy (nginx: location ^~ /admin/queues { return 404; }).
• 6. Publish port 3000 only to localhost (127.0.0.1:3000:3000) and expose via VPN, SSH tunnel, or authenticated proxy.
• 7. Export chatflows, agentflows, tools, variables as JSON and back up the .flowise data folder and related paths.
• 8. Plan migration to maintained self-hosted builders (Langflow, Dify, n8n) or vetted community forks, ensuring they contain fixes for the advisories.

Evidence

Flowise 3.1.4 is released, and the code freeze starts. No more pull requests are reviewed.

Source

All affect every version up to and including 3.1.4, and all list no patched version.

Source

Two critical, Enterprise SSO only. Flowise matches SSO users by email alone. Anyone who gets a verified sign-in for your email at any configured provider, for example a self-registered Auth0 account, gets your session.

Source

Block /admin/queues at the proxy. In nginx that's location ^~ /admin/queues { return 404; }

Source

Keep port 3000 private. Publish it as 127.0.0.1:3000:3000, because on Linux Docker-published ports skip ufw.

Source