Deer Flow CVE-2026-40518

Upgrade to ByteDance DeerFlow commit 2176b2bbfccfce25ceee08318813f96d843a13fd or later, which implements proper path validation for agent names in bootstrap-mode custom-agent creation. The patch is available via GitHub at https://github.com/bytedance/deer-flow/commit/2176b2bbfccfce25ceee08318813f96d843a13fd. Organizations unable to immediately patch should implement defense-in-depth controls: (1) Restrict custom-agent creation permissions to trusted administrator accounts only, reducing the attack surface to insider threats; (2) Deploy filesystem-level write restrictions ensuring the DeerFlow application process cannot write to sensitive directories like configuration roots, binary directories, or web-accessible paths (note: this limits impact but does not prevent exploitation, and may interfere with legitimate agent operations); (3) Enable comprehensive filesystem audit logging to detect path traversal attempts in agent name parameters; (4) If DeerFlow is exposed to untrusted networks, place it behind authentication gateways requiring MFA for low-privilege accounts. Review existing custom-agent configurations for suspicious names containing '../' sequences or absolute paths, which may indicate prior exploitation attempts. Compensating controls reduce but do not eliminate risk-patching remains the primary mitigation.