CVE-2026-41268

CRITICAL

Flowise: Flowise Parameter Override Bypass Remote Command Execution

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-41268 has a selected CVSS score of 9.8 (critical).

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODE_OPTIONS environment variable injection. This allows for the execution of arbitrary system commands with root privileges within the containerized Flowise instance, requiring only a single HTTP request and no authentication or knowledge of the instance. This vulnerability is fixed in 3.1.0.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2026 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

Flowise

Browse FlowiseAI / Flowise
CVE List< 3.1.0affected

flowise

Browse npm / flowise
GitHub AdvisoryBefore 3.1.0 · Fixed in 3.1.0affected

flowise-components

Browse npm / flowise-components
GitHub AdvisoryBefore 3.1.0 · Fixed in 3.1.0affected

References

3