Flowsint CVE-2026-42156

Exploitation requires an authenticated session with permission to create a node (CVSS PR:L), and the attacker must control the node's 'type' attribute, which is concatenated into a Cypher query - this specific field and the node-creation feature ARE the prerequisite. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N) against any version prior to 1.2.3. Exploitation is limited by the need for valid credentials/low-privilege access to the instance; instances that are not internet-exposed or that tightly control account provisioning materially reduce realistic risk. CISA SSVC rates the attack as not automatable, indicating it is not readily weaponized for mass, hands-off exploitation.

Signals are moderate and largely consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, base 7.1 High) indicates network-reachable, low-complexity exploitation requiring only low-level authentication and no user interaction, with impact scoped to high confidentiality. EPSS is low at 0.16% (37th percentile), and CISA SSVC rates Exploitation as 'poc', Automatable 'no', and Technical Impact 'partial' - meaning exploit code exists but mass, automated exploitation is not expected. There is a notable tension worth flagging: the vendor vector limits impact to confidentiality (VI:N/VA:N), yet the description states the attacker can 'execute an arbitrary Cypher query', which realistically permits data modification and deletion, not just disclosure - verify integrity/availability exposure with the vendor. Overall this is a real but not emergency-tier issue: it requires an authenticated foothold and is not flagged as automatable or actively exploited, so it warrants prompt patching rather than out-of-band response.

An attacker with a low-privilege Flowsint account creates a new investigation node and sets its 'type' field to a payload containing Cypher control characters that terminate the intended query and append attacker-chosen clauses. When the application executes the generated Cypher statement, the injected clauses run, letting the attacker enumerate and exfiltrate other users' graph data (and potentially modify it). Public proof-of-concept exploit code is indicated by the CISA SSVC 'poc' rating, lowering the skill required.