Flowise SQLite Record Manager Flaw Enables Root RCE (CVE-2026-69259)

What happened

Security firm elttam disclosed a remote code execution vulnerability (CVE-2026-69259) in FlowiseAI/Flowise, the open-source low-code platform for building AI applications, affecting version 3.1.2. According to the advisory, the "SQLite Record Manager" node exposed an additionalConfig input that let a user override the intended database file path via object spread, allowing an SQLite database file to be written to an arbitrary filesystem location — including system directories, since the official flowiseai/flowise:3.1.2 Docker image runs as root.

The report details how, even though the SQL tableName input was regex-validated, researchers manipulated SQLite's binary record structure (abusing table-name length encoding) to inject a stray quote into the database file, which combined with the unsanitized namespace field to smuggle a shell command. Writing this crafted database to /etc/chromium/*.conf and then triggering a Puppeteer-launched Chromium browser (which sources those conf files) caused the injected command to execute — demonstrated as a reverse shell running as root. A public proof-of-concept is referenced in the advisory.

Why it matters for defenders

Per the advisory, exploitation requires only an authenticated user on a Flowise instance using the published Docker image, and results in full compromise of the container as root. Organizations self-hosting Flowise for internal AI workflow/agent building are the ones exposed — any authenticated user (not just admins) could potentially leverage this node to escalate to root RCE. This is notable as part of a pattern of Flowise record-manager/database-node RCEs (the advisory itself references a related prior finding, GHSA-pwfj-wh95-7mwp).

What defenders should watch for or do now

• Inventory whether Flowise is deployed internally, and confirm the version in use — this report is specific to 3.1.2 and the SQLite Record Manager node.
• Check for and apply any vendor patch or advisory guidance restricting the additionalConfig input from overriding the database path.
• Review container runtime configuration: the advisory explicitly calls out running the Flowise image as a low-privileged user instead of root as a mitigating control, independent of the code fix.
• Monitor for unexpected writes to system paths such as /etc/chromium/*.conf or unexplained SQLite files appearing outside the application's data directory, and for anomalous outbound connections or shell spawns from the Flowise/Chromium (Puppeteer) process tree.
• Restrict who can author/import Chatflows and configure record-manager nodes, since the advisory notes any authenticated user could attempt this technique.

Developing intel

This is a newly published advisory (disclosed 2026-04-24, reported here as same-day intel) and details may evolve as vendor patches and further community analysis emerge. For the full technical write-up and proof-of-concept references, see the original GHSA advisory: GHSA-x3hf-7cj6-3r4m.