CVE-2026-69259: Flowise RCE — UNKNOWN

Q: Is CVE-2026-69259 actively exploited?

No confirmed active exploitation of CVE-2026-69259 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-69259?

Upgrade flowise and flowise-components to 3.1.3 or later immediately. As a compensating control, rebuild/run the Flowise Docker image with a non-root user regardless of patch status — this single change breaks the exploit's ability to write to /etc/chromium/. Restrict which authenticated users/roles can create or edit Record Manager nodes and audit additionalConfig fields for unexpected database/table/namespace values. Detection: monitor for unexpected writes under /etc/chromium/, unexpected SQLite files outside the app's data directory, and anomalous shell execution spawned from the Chromium/Puppeteer process tree.

Q: What systems are affected by CVE-2026-69259?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, browser automation/tool use, vector/record management.

Q: What is the CVSS score for CVE-2026-69259?

No CVSS score has been assigned yet.

CISO Take

Flowise's SQLite Record Manager node fails to validate a user-supplied additionalConfig object, letting an authenticated attacker overwrite the intended database file path and redirect writes to arbitrary filesystem locations. Because the official Docker image runs as root, the attacker can write a crafted SQLite file to /etc/chromium/exploit.conf and embed shell syntax via the table name and namespace fields, which executes the next time Flowise's Puppeteer integration launches Chromium and the runtime sources /etc/chromium/*.conf. There's no CISA KEV listing, no public exploit or Nuclei template, and EPSS sits at a low 0.35% — CISA's SSVC decision is ATTEND, meaning track but not urgent remediation. The requirement for an authenticated account and specific Docker misconfiguration knowledge (root user, Chromium config sourcing) keeps real-world exploitation likelihood modest, but the blast radius is total container compromise for any self-hosted Flowise agent workflow. Patch to flowise/flowise-components 3.1.3 immediately, and independently harden the container to run as a non-root user regardless of patch status.

Sources: NVD GitHub Advisory EPSS CISA KEV CISA SSVC ATLAS github.com

What is the risk?

Moderate-to-high technical severity (root-level code execution) offset by a meaningful precondition: the attacker must already hold an authenticated Flowise account and understand the specific database-path-overwrite plus Chromium-config-sourcing chain. No CVSS score is published, it's absent from CISA KEV, no public exploit code or Nuclei template exists, and EPSS is low (0.35%). CISA SSVC rates it ATTEND. The real risk driver is deployment hygiene: the vulnerability is only dangerous to the extent the published Docker image (running as root) is used unmodified in production, which is a common default for self-hosted low-code AI agent platforms.

How does the attack unfold?

Authenticated Access

Attacker with a valid Flowise account configures a SQLite Record Manager node and sets additionalConfig.database to a sensitive path like /etc/chromium/exploit.conf.

AML.T0012

Config Overwrite & Injection

The vulnerable code spreads additionalConfig after the intended database setting, letting the attacker's path win, and embeds shell syntax via the controlled table name and namespace values.

AML.T0050

Trigger via Agent Tool

A flow feature invokes Puppeteer to launch Chromium, which sources /etc/chromium/*.conf on startup and executes the planted shell syntax.

AML.T0053

Root Command Execution

Because the published Docker image runs as root, the executed shell syntax grants the attacker full control of the Flowise container.

AML.T0105

Authenticated Access

Attacker with a valid Flowise account configures a SQLite Record Manager node and sets additionalConfig.database to a sensitive path like /etc/chromium/exploit.conf.

AML.T0012

Config Overwrite & Injection

The vulnerable code spreads additionalConfig after the intended database setting, letting the attacker's path win, and embeds shell syntax via the controlled table name and namespace values.

AML.T0050

Trigger via Agent Tool

A flow feature invokes Puppeteer to launch Chromium, which sources /etc/chromium/*.conf on startup and executes the planted shell syntax.

AML.T0053

Root Command Execution

Because the published Docker image runs as root, the executed shell syntax grants the attacker full control of the Flowise container.

AML.T0105

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	<= 3.1.2	`3.1.3`
Flowise	npm	<= 3.1.2	`3.1.3`

How severe is it?

CVSS 3.1

N/A

EPSS

0.7%

chance of exploitation in 30 days

Higher than 51% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Advanced

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Upgrade flowise and flowise-components to 3.1.3 or later immediately. As a compensating control, rebuild/run the Flowise Docker image with a non-root user regardless of patch status — this single change breaks the exploit's ability to write to /etc/chromium/. Restrict which authenticated users/roles can create or edit Record Manager nodes and audit additionalConfig fields for unexpected database/table/namespace values. Detection: monitor for unexpected writes under /etc/chromium/, unexpected SQLite files outside the app's data directory, and anomalous shell execution spawned from the Chromium/Puppeteer process tree.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - AI system security controls

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM07:2025 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-69259?

Flowise's SQLite Record Manager node fails to validate a user-supplied additionalConfig object, letting an authenticated attacker overwrite the intended database file path and redirect writes to arbitrary filesystem locations. Because the official Docker image runs as root, the attacker can write a crafted SQLite file to /etc/chromium/exploit.conf and embed shell syntax via the table name and namespace fields, which executes the next time Flowise's Puppeteer integration launches Chromium and the runtime sources /etc/chromium/*.conf. There's no CISA KEV listing, no public exploit or Nuclei template, and EPSS sits at a low 0.35% — CISA's SSVC decision is ATTEND, meaning track but not urgent remediation. The requirement for an authenticated account and specific Docker misconfiguration knowledge (root user, Chromium config sourcing) keeps real-world exploitation likelihood modest, but the blast radius is total container compromise for any self-hosted Flowise agent workflow. Patch to flowise/flowise-components 3.1.3 immediately, and independently harden the container to run as a non-root user regardless of patch status.

Is CVE-2026-69259 actively exploited?

No confirmed active exploitation of CVE-2026-69259 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-69259?

Upgrade flowise and flowise-components to 3.1.3 or later immediately. As a compensating control, rebuild/run the Flowise Docker image with a non-root user regardless of patch status — this single change breaks the exploit's ability to write to /etc/chromium/. Restrict which authenticated users/roles can create or edit Record Manager nodes and audit additionalConfig fields for unexpected database/table/namespace values. Detection: monitor for unexpected writes under /etc/chromium/, unexpected SQLite files outside the app's data directory, and anomalous shell execution spawned from the Chromium/Puppeteer process tree.

What systems are affected by CVE-2026-69259?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, browser automation/tool use, vector/record management.

What is the CVSS score for CVE-2026-69259?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesbrowser automation/tool usevector/record management

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07:2025

What are the technical details?

Original Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended database setting, allowing additionalConfig.database to overwrite the SQLite database path. An authenticated attacker using the published Docker image, which ran as root, could write a SQLite database to paths such as /etc/chromium/exploit.conf; by controlling the table name and namespace value, the attacker could place shell syntax into the database file and trigger execution when Puppeteer launched Chromium and sourced /etc/chromium/*.conf. This issue is fixed in version 3.1.3.

Exploitation Scenario

An attacker with a valid (even low-privilege) Flowise account configures a SQLite Record Manager node in a flow and sets additionalConfig.database to /etc/chromium/exploit.conf, which the vulnerable code spreads over the intended path. They craft the table name and namespace values to embed shell command syntax, then save the flow so Flowise writes the malicious SQLite file to that path. Next, they trigger any flow feature that invokes Puppeteer to launch Chromium (e.g., a web-scraping or screenshot tool node); Chromium's startup process sources files under /etc/chromium/*.conf, executing the attacker's injected shell syntax as root inside the container — giving full control of the Flowise instance and everything it can reach.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.