CVE-2026-41268 is a critical vulnerability in FlowiseAI's Flowise product before version 3.1.0. It stems from improper input validation (CWE-20) that enables unauthenticated remote command execution (RCE). The exploit involves using the FILE-STORAGE:: keyword combined with NODE_OPTIONS environment variable injection to override parameters and execute arbitrary system commands with root privileges within the container. This can be triggered remotely via a single HTTP request without authentication or prior knowledge of the instance. The vulnerability is addressed in Flowise version 3.1.0.

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands with root privileges inside the containerized Flowise environment. This compromises confidentiality, integrity, and availability of the affected system. The CVSS score of 7.7 reflects high severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity with low impact on availability.

Upgrade Flowise to version 3.1.0 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, users should verify the version and update accordingly. Patch status is confirmed fixed in 3.1.0. No other mitigations are indicated.