CVE-2026-96428: Flowring Agentflow 4.0 SQLi Vulnerability

CVE-2026-96428 Overview

CVE-2026-96428 is a SQL injection vulnerability in Flowring Agentflow 4.0. The flaw resides in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint. Remote attackers can execute arbitrary SQL commands by passing crafted input through the words parameter. The vulnerability affects Flowring Agentflow 4.0 versions released before 2025/08/08. Exploitation requires no authentication and no user interaction, exposing enterprise workflow data to unauthenticated network attackers. The issue is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL commands against the backend database, resulting in full compromise of confidentiality, integrity, and availability of the Agentflow data store.

Affected Products

Flowring Agentflow 4.0 (versions released before 2025/08/08)
/WebAgenda/SMBAjaxAutoComplete.do API endpoint
Deployments exposing the WebAgenda module to untrusted networks

Discovery Timeline

2026-09-29 - CVE-2026-96428 published to the National Vulnerability Database
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-96428

Vulnerability Analysis

The vulnerability exists in the SMBAjaxAutoComplete.do endpoint under the /WebAgenda/ application path. This endpoint powers an autocomplete feature and accepts a words parameter from client requests. The application concatenates the words value directly into a SQL statement before executing it against the backend database. An attacker can supply SQL metacharacters and query fragments through this parameter to alter the intended query logic. Successful exploitation allows extraction of arbitrary data, modification of records, or execution of database-native commands depending on the underlying database engine and privileges granted to the application account.

Root Cause

The root cause is improper neutralization of user-controlled input before it is incorporated into a SQL query [CWE-89]. The SMBAjaxAutoComplete.do handler fails to use parameterized queries or prepared statements for the words parameter. Because the endpoint is reachable without authentication, any client that can reach the WebAgenda module over the network can trigger the flaw.

Attack Vector

Attackers exploit the flaw over the network by issuing HTTP requests to /WebAgenda/SMBAjaxAutoComplete.do with a malicious words value. The request requires no session, credentials, or user interaction. Typical exploitation techniques include boolean-based blind SQL injection, UNION-based extraction, and time-based inference to enumerate schemas, dump credentials, or pivot to operating system access via database-native functions. Full technical details are available in the Zuso AI CVE Advisory.

Detection Methods for CVE-2026-96428

Indicators of Compromise

HTTP requests to /WebAgenda/SMBAjaxAutoComplete.do containing SQL metacharacters such as single quotes, UNION SELECT, --, /*, or SLEEP( in the words parameter.
Unusual database error responses or long response times returned by the WebAgenda endpoint.
Web server logs showing repeated requests to SMBAjaxAutoComplete.do from a single external source with varying words payloads.
Database audit logs showing schema enumeration queries against information_schema or system catalog tables originating from the Agentflow service account.

Detection Strategies

Deploy web application firewall signatures that inspect the words query parameter for SQL injection patterns targeting the affected endpoint path.
Enable database query logging and alert on unexpected UNION, sleep, or metadata queries issued by the Agentflow application user.
Correlate high-volume requests to /WebAgenda/SMBAjaxAutoComplete.do with response size anomalies to identify data exfiltration attempts.

Monitoring Recommendations

Forward Agentflow application, web server, and database logs to a centralized analytics platform for correlation and retention.
Establish a baseline of normal SMBAjaxAutoComplete.do traffic and alert on deviations in request rate, parameter length, or character composition.
Monitor egress traffic from the Agentflow server for large or unusual outbound transfers that may indicate data theft.

How to Mitigate CVE-2026-96428

Immediate Actions Required

Upgrade Flowring Agentflow 4.0 to the fixed release dated 2025/08/08 or later as documented in the Zuso AI CVE Advisory.
Restrict network exposure of the /WebAgenda/ application path to trusted internal networks or VPN users until patching is complete.
Review database and web server logs for evidence of prior exploitation attempts against SMBAjaxAutoComplete.do.
Rotate credentials for the database account used by the Agentflow application if compromise is suspected.

Patch Information

Flowring addressed the vulnerability in Agentflow 4.0 builds released on or after 2025/08/08. Administrators should consult the vendor advisory and the Zuso AI CVE Advisory for the specific patched build identifier that applies to their deployment before scheduling an upgrade window.

Workarounds

Block requests to /WebAgenda/SMBAjaxAutoComplete.do at the reverse proxy or WAF where the autocomplete feature is not required.
Apply WAF rules that reject words parameter values containing SQL metacharacters or exceeding an expected maximum length.
Enforce least privilege on the database account used by Agentflow so it cannot access unrelated schemas or execute administrative commands.

bash

# Example NGINX rule to block the vulnerable endpoint until patched
location = /WebAgenda/SMBAjaxAutoComplete.do {
    deny all;
    return 403;
}