CVE-2026-41274: Flowise Cypher Injection Vulnerability in GraphCypherQAChain

# CVE-2026-41274: Flowise Cypher Injection Vulnerability in GraphCypherQAChain

https://gcdradar.vercel.app/incidents/cve-2026-41274-flowise-cypher-injection-vulnerability-in-gra · AIR-2026-0574 · closed 2026-04-16

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-04-16
- AI role: Attack on AI
- Products: Flowise
- CVE ids: CVE-2026-41274
- CVSS: 8.7

## Summary

An unauthenticated Cypher injection vulnerability exists in the Flowise GraphCypherQAChain node due to unsanitized user input forwarded to the database. An attacker can execute arbitrary Cypher queries to exfiltrate or modify data on the underlying Neo4j database.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-04-23: CVE-2026-41274: Flowise is a drag & drop user interface to build a customized large language model flow. (https://nvd.nist.gov/vuln/detail/CVE-2026-41274)
- 2026-04-16: CVE-2026-41274: Flowise: Cypher Injection in GraphCypherQAChain (https://github.com/advisories/GHSA-28g4-38q8-3cwc)

## Sources

- 2026-04-16 GitHub Advisory Database: CVE-2026-41274: Flowise: Cypher Injection in GraphCypherQAChain https://github.com/advisories/GHSA-28g4-38q8-3cwc
- 2026-04-23 NVD: CVE-2026-41274: Flowise is a drag & drop user interface to build a customized large language model flow. https://nvd.nist.gov/vuln/detail/CVE-2026-41274

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.