CVE-2026-42156: Cypher Injection in Flowsint

Successful exploitation of CVE-2026-42156 allows an attacker to craft a malicious node type within Flowsint. This crafted node, when processed, can escape the intended Cypher query and execute arbitrary Cypher commands. The potential impact is significant, ranging from data exfiltration of sensitive OSINT data to complete compromise of the underlying graph database. An attacker could potentially modify or delete data, gain unauthorized access to connected systems, or even execute commands on the server hosting Flowsint, depending on the database permissions. The blast radius extends to any systems or data accessible through the Flowsint graph.

1. Published2026-05-12

The primary mitigation for CVE-2026-42156 is to upgrade Flowsint to version 1.2.3 or later, which contains the fix for this Cypher injection vulnerability. If upgrading immediately is not feasible, consider implementing input validation on any user-supplied data used to create nodes within Flowsint. This can help prevent the creation of malicious node types. While a WAF or proxy cannot directly prevent this vulnerability, it can be configured to monitor for unusual Cypher query patterns that might indicate exploitation. Regularly review Flowsint's configuration and ensure that database access permissions are appropriately restricted. After upgrading, verify the fix by attempting to create a node with a potentially malicious type and confirming that the Cypher query remains unchanged.