CVE-2026-69251: Flowise RCE Vulnerability

CVE-2026-69251 Overview

CVE-2026-69251 is an arbitrary code execution vulnerability in Flowise, a drag-and-drop interface for building large language model workflows. Versions prior to 3.1.3 expose TypeORM DataSource options through the additionalConfig input on record manager and agent memory nodes. Authenticated users can supply entities, subscribers, or migrations paths that reference attacker-controlled JavaScript files, causing the server to load and execute them. The flaw is tracked under CWE-94: Improper Control of Generation of Code and is fixed in Flowise 3.1.3.

Critical Impact
An authenticated Flowise user can execute arbitrary code on the underlying server by uploading a JavaScript payload and referencing it from additionalConfig.entities.

Affected Products

Flowise versions prior to 3.1.3
Deployments using MySQL, PostgreSQL, or SQLite Record Manager nodes
Deployments using Agent Memory nodes, including MySQL Agent Memory

Discovery Timeline

2026-08-04 - CVE-2026-69251 published to the National Vulnerability Database
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-69251

Vulnerability Analysis

Flowise exposes several database-backed nodes that accept a free-form additionalConfig object. This object is passed directly into a TypeORM DataSource constructor. TypeORM supports options such as entities, subscribers, and migrations, each of which accepts filesystem paths or glob patterns. When the DataSource initializes, TypeORM requires the referenced files, executing any top-level JavaScript they contain.

Because Flowise does not filter these keys, an authenticated user can point entities at an arbitrary path on the server. Combined with Flowise's file upload capabilities, an attacker can stage a malicious .js file and load it through node initialization. Execution occurs in the Flowise process context, granting access to environment variables, credentials, and any resources reachable from the host.

Root Cause

The root cause is unsafe merging of user-supplied configuration into a security-sensitive object graph. The affected files include packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts, packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts, packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts, packages/components/nodes/memory/AgentMemory/MySQLAgentMemory/MySQLAgentMemory.ts, and packages/components/nodes/memory/AgentMemory/AgentMemory.ts. None of these paths validated that keys in additionalConfig were limited to safe connection parameters.

Attack Vector

Exploitation requires an authenticated Flowise session with permission to create or edit flows. The attacker uploads a JavaScript payload to a path reachable by the Flowise process, then configures a record manager or agent memory node with additionalConfig containing an entities entry that references the uploaded file. When the flow executes and the node initializes its TypeORM data source, Node.js loads and runs the payload. See the Flowise GitHub Security Advisory GHSA-g32j-mmxr-gfq5 for the vendor's technical description.

Detection Methods for CVE-2026-69251

Indicators of Compromise

Unexpected .js files written under Flowise upload or storage directories by low-privilege users
Flowise node configurations containing additionalConfig.entities, additionalConfig.subscribers, or additionalConfig.migrations referencing filesystem paths
Child processes spawned by the Flowise Node.js process that do not correspond to normal LLM or database activity
Outbound network connections from the Flowise host to unfamiliar destinations following flow edits

Detection Strategies

Audit stored flow definitions for record manager and agent memory nodes whose additionalConfig includes entity, subscriber, or migration keys
Monitor the Flowise process for require() calls that resolve outside the application's node_modules and source tree
Alert on file uploads with .js, .mjs, or .cjs extensions to Flowise storage directories

Monitoring Recommendations

Log all authenticated Flowise API calls that create or modify nodes and forward them to a centralized SIEM
Track process ancestry from the Flowise service to catch unexpected shell, curl, or interpreter execution
Baseline outbound network traffic from Flowise hosts and alert on deviations after configuration changes

How to Mitigate CVE-2026-69251

Immediate Actions Required

Upgrade all Flowise instances to version 3.1.3 or later
Review existing flows for record manager and agent memory nodes containing additionalConfig.entities, subscribers, or migrations and remove any suspicious entries
Rotate database credentials, API keys, and secrets accessible to the Flowise process if exploitation is suspected
Restrict Flowise account creation and enforce least-privilege access for flow authors

Patch Information

The issue is fixed in Flowise 3.1.3. The patch restricts additionalConfig to a safe subset of TypeORM DataSource options, blocking the entities, subscribers, and migrations keys. Refer to the Flowise Security Advisory GHSA-g32j-mmxr-gfq5 for release details.

Workarounds

Place Flowise behind an authenticated reverse proxy and limit access to trusted operators until patching is complete
Run the Flowise service under a dedicated, unprivileged user account with a restricted filesystem view
Disable file upload functionality or mount the upload directory noexec to reduce the impact of staged payloads
Apply egress network filtering on the Flowise host to contain post-exploitation activity

bash

# Upgrade Flowise to the patched release
npm install -g flowise@3.1.3

# Or, for Docker deployments, pin the patched image tag
docker pull flowiseai/flowise:3.1.3
docker stop flowise && docker rm flowise
docker run -d --name flowise -p 3000:3000 flowiseai/flowise:3.1.3