If you are running Flowise in production, check your logs for a suspiciously high volume of the word "hello." Security researchers at Era have identified a new exploitation framework, dubbed Greeter, that weaponizes the open-source agentic platform’s chat interface to execute remote code. The attack hides malicious commands within a series of rapid, benign-looking messages, leaving stored chat histories looking like a malfunctioning bot while the underlying API executes shell commands.

The Invisible Payload

The core of the Greeter framework is its exploitation of CVE-2024-58351, a vulnerability in Flowise’s runtime configuration. By injecting a javascriptFunction into the overrideConfig parameter of the prediction API, attackers can replace the code inside Custom JavaScript Function nodes on a per-request basis. This means the malicious code never persists to the database. The stored chatflow remains entirely benign, but every time a user sends "hello," the API executes a different stage of the attack, from initial liveness checks to full system reconnaissance.

Reconnaissance and Cloud Exposure

Era’s honeypots, which recorded attacks from July to October 2026, captured a 12-step attack chain. After verifying the host was alive, the framework dumped a 1MB response containing 19 different system commands, all labeled with Chinese delimiters. It probed for Docker sockets, listed environment variables, and attempted to access cloud metadata services (IMDS) on AWS and Google Cloud. This reconnaissance phase is critical because it maps the path from a compromised AI application to the broader cloud identity, potentially exposing IAM roles and service account tokens.

Persistence and Fileless Execution

The framework doesn't just spy; it prepares to stay. Greeter attempts to deploy persistence mechanisms disguised as legitimate system daemons, using names like polld-keeper and varrun-watcher to blend in with standard Linux processes. It also checks for fileless execution capabilities, verifying if it can load payloads directly into memory using memfd_create(). This technique leaves fewer artifacts on disk, making incident response significantly harder for teams relying solely on host-based file monitoring.

Scale of the Threat

The exposure is not hypothetical. A Shodan scan identified 4,372 unique Flowise instances exposed to the internet. Of those, 21.5% had no authentication enabled, and 46 instances showed the specific vulnerable conditions exploited by Greeter. With over 55,000 GitHub stars and over five million Docker image pulls, Flowise is a massive target surface. The framework’s ability to turn a single exposed API endpoint into a foothold for cloud credential theft highlights a growing gap between application-level security and infrastructure hygiene.

Key Takeaways

  • Authentication is Non-Negotiable: 21.5% of exposed Flowise instances lack auth, making them low-hanging fruit for automated scanners.
  • Logs Lie: Stored chat messages may only show "hello," while the API executes complex shell commands via overrideConfig.
  • Cloud Identities are the Prize: The framework specifically targets IMDS and environment variables to escalate from an app breach to a cloud account compromise.
  • Fileless Matters: Attackers are checking for memory execution capabilities to evade disk-based detection.

The Bottom Line

Your AI app isn't just a chatbot; it's a privileged execution environment with cloud credentials. If you haven't scoped your IAM roles tightly, Greeter just proved how easy it is to walk from a 'hello' to a full cloud takeover.