CVE-2026-69256 FlowiseAI CVE debrief

Who should care

System administrators and security teams responsible for Flowise installations, especially those with multi-user environments where chatflow creation and modification permissions are delegated to users or teams.

Technical summary

The CSVAgent node in Flowise, a drag & drop user interface for building customized large language model flows, was vulnerable to code execution. An authenticated user who could create or modify a chatflow could add a CSV Agent, include a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger the /api/v1/prediction/<UUID> endpoint to execute arbitrary commands. This was due to the pandas.read_pickle() function being used to deserialize a pickled payload, which could bypass the denylist of dangerous Python constructs. The issue was addressed in Flowise version 3.1.3.

Defensive priority

Authenticated users with chatflow creation or modification permissions should verify and restrict usage of the CSVAgent node, especially in environments where untrusted users have such access.

Recommended defensive actions

• Verify and restrict usage of the CSVAgent node in Flowise installations, especially in environments where untrusted users have chatflow creation or modification permissions.
• Update Flowise to version 3.1.3 or later to apply the fix for CVE-2026-69256.
• Monitor chatflow modifications and user activities for suspicious behavior related to the CSVAgent node.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE-2026-69256 issue involves the CSVAgent node in Flowise, which allowed users to execute Python code through pyodice. Although a denylist was in place, it was found that pandas.read_pickle() could be used to deserialize a pickled payload, leading to code execution. This was possible because the denylist did not block this specific function. The issue was addressed in version 3.1.3 of Flowise.

Official resources