What happened
Era Security researchers identified a campaign (named for 'hello' messages planted in logs to hide tracks) that uses Shodan to find publicly exposed, unpatched Flowise GenAI deployments. It exploits CVE-2024-58351 — an unauthenticated code-injection flaw in Flowise before 2.1.4 where a runtime overrideConfig request parameter replaces the code of a Custom JavaScript Function node for that single request, so the saved chatflow definition is never modified. The injected code returns host reconnaissance, probes the cloud metadata service for IAM credentials, and harvests tokens, then pivots laterally across AWS regions. Era observed 'hello'-only chat histories and ~46 confirmed affected deployments (of ~3,277 version-reporting instances, 703 had no auth); roughly 90% of ~3,000 scanned Flowise instances remain unpatched.
Why it matters
This is an in-the-wild, AI-led campaign that turns intentionally ephemeral, self-hosted AI-orchestration workloads into quiet beachheads for cloud-account takeover. Flowise (an LLM-agent builder) was retired by Workday on 2026-08-31 and the repo archived, so remaining self-hosted instances get no patches and become permanent exposure. It demonstrates the 'AI infrastructure as initial foothold' pattern targeting GenAI platforms rather than classic container-escape or Docker-API vectors.
Attack vector
Automated Shodan reconnaissance of exposed Flowise; one request injects a per-request JavaScript overrides payload that runs code with the workflow's privileges, then queries instance metadata for IAM/GCP credentials and pivots into the cloud account.
Affected systems
Flowise < 2.1.4 (retired project, archived Aug 2026); self-hosted and unpatched forks
Mitigation
Patch Flowise to 2.1.4+ or migrate/decommission (project retired & unmaintained); enforce IMDSv2 and remove over-broad instance roles; restrict egress and network segmentation around AI orchestration; monitor for single-word ('hello') chat inputs and unexpected metadata calls.