CVE-2026-42156: Flowsint OSINT Tool RCE Vulnerability

CVE-2026-42156 Overview

CVE-2026-42156 is a Cypher injection vulnerability in Flowsint, an open-source Open Source Intelligence (OSINT) graph exploration tool used for cybersecurity investigation, transparency, and verification. Versions prior to 1.2.3 permit a remote authenticated attacker to create a node with a malicious type value that escapes the bounds of an existing Cypher query. The flaw allows execution of arbitrary Cypher queries against the underlying graph database. The issue is tracked under [CWE-943: Improper Neutralization of Special Elements in Data Query Logic] and is fixed in Flowsint version 1.2.3.

Critical Impact

Authenticated remote attackers can execute arbitrary Cypher queries, leading to unauthorized read access to graph data stored by Flowsint.

Affected Products

• Flowsint versions prior to 1.2.3
• Flowsint deployments exposing node-creation APIs to untrusted users
• Graph database backends queried by vulnerable Flowsint instances

Discovery Timeline

• 2026-05-12 - CVE-2026-42156 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42156

Vulnerability Analysis

Flowsint constructs Cypher queries by concatenating user-controlled values, including the type attribute supplied when creating a graph node. Cypher is the query language used by graph databases such as Neo4j. When user input is interpolated directly into a query string without parameterization, attacker-supplied syntax is interpreted as query logic rather than data.

A remote attacker with permission to create nodes can craft a type field that closes the current Cypher clause and appends additional statements. The injected statements run with the privileges of the application's database account. The published advisory limits documented impact to confidentiality, consistent with read-oriented Cypher operations against the graph store.

Root Cause

The root cause is unsafe query construction. Cypher node types are concatenated into queries rather than bound through parameterized statements. Cypher labels and relationship types cannot be parameterized in standard drivers, so they must be strictly validated against an allow-list before interpolation. Flowsint releases prior to 1.2.3 did not enforce this validation, enabling the injection. Refer to the GitHub Security Advisory GHSA-h5m2-c2c5-968p for upstream technical details.

Attack Vector

Exploitation requires network access to the Flowsint application and a low-privilege authenticated session capable of invoking the node-creation workflow. The attacker submits a node creation request where the type parameter contains Cypher syntax designed to terminate the legitimate clause and append an arbitrary query. No user interaction is required.

// No verified exploit code is published.
// See the upstream advisory GHSA-h5m2-c2c5-968p for details.

Detection Methods for CVE-2026-42156

Indicators of Compromise

• Node creation requests containing Cypher keywords such as MATCH, RETURN, CREATE, DELETE, or WITH inside the type field.
• Unexpected backticks, curly braces, or closing parentheses in node type values submitted to Flowsint APIs.
• Graph database query logs showing statements that do not match application-generated query templates.

Detection Strategies

• Enable query logging on the backing Neo4j or compatible graph database and alert on queries that include multiple statements or unexpected clauses originating from the Flowsint service account.
• Inspect application logs for node creation events where the type value contains whitespace, quotes, or Cypher reserved words.
• Compare running Flowsint versions against 1.2.3 across all environments to surface unpatched instances.

Monitoring Recommendations

• Forward Flowsint application logs and graph database audit logs to a centralized analytics platform for correlation.
• Baseline normal node type values used by the application and alert on deviations.
• Monitor authenticated API sessions for anomalous bursts of node creation requests that may indicate enumeration or injection testing.

How to Mitigate CVE-2026-42156

Immediate Actions Required

• Upgrade Flowsint to version 1.2.3 or later on all instances.
• Audit existing graph data for nodes whose type values contain Cypher syntax, indicating prior injection attempts.
• Rotate credentials used by Flowsint to access the graph database if exploitation is suspected.
• Restrict Flowsint API access to trusted, authenticated users only.

Patch Information

The maintainers of Flowsint released version 1.2.3 to remediate CVE-2026-42156. Details and remediation guidance are documented in the GitHub Security Advisory GHSA-h5m2-c2c5-968p. Upgrading is the recommended path because Cypher labels and types cannot be safely parameterized through standard driver bindings.

Workarounds

• If immediate upgrade is not possible, restrict node creation to administrators using application-level authorization controls.
• Place a reverse proxy or web application firewall in front of Flowsint to block requests whose type parameter contains Cypher reserved keywords or special characters.
• Reduce the privileges of the database account used by Flowsint so that it cannot execute write or administrative Cypher commands.

# Upgrade Flowsint to the fixed release
git fetch --tags
git checkout v1.2.3
# Reinstall dependencies and restart the service per project documentation