CVE-2026-41268: Flowise: Flowise Parameter Override Bypass Remote Command Execution
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODEOPTIONS environment variable injection. This allows for the execution of arbitrary system commands with root privileges within the containerized Flowise instance, requiring only a single HTTP request and no authentication or knowledge of the instance. This vulnerability is fixed in 3.1.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41268?
CVE-2026-41268 has been classified as a critical vulnerability due to its potential for unauthenticated remote command execution.
How do I fix CVE-2026-41268?
To mitigate CVE-2026-41268, upgrade Flowise to version 3.1.0 or later immediately.
What are the risks associated with CVE-2026-41268?
The primary risk of CVE-2026-41268 is the ability for attackers to execute arbitrary commands on the affected system.
Who is affected by CVE-2026-41268?
CVE-2026-41268 affects all users of Flowise versions prior to 3.1.0.
Is CVE-2026-41268 easy to exploit?
Yes, CVE-2026-41268 can be exploited easily due to its unauthenticated nature.