Deer Flow EUVD-2026-23456

Requires authenticated access to ByteDance DeerFlow with permissions to create custom agents in bootstrap mode. The CVSS vector PR:L indicates low-privilege authentication is sufficient-administrative access is NOT required. Exploitation specifically targets the bootstrap-mode custom-agent creation workflow; standard agent operations are not affected. The DeerFlow instance must be accessible to the attacker (AV:N indicates network accessibility, though this could include internal network access). Impact is constrained by the filesystem permissions of the DeerFlow application process-arbitrary file write succeeds only in locations where the process has write privileges. Deployments restricting custom-agent creation to administrators or running DeerFlow with minimal filesystem permissions limit exploitability. No user interaction required (UI:N) once the attacker has authenticated access.

Real-world risk is MODERATE-HIGH with important caveats. CVSS 7.1 (High integrity impact, Low availability impact) accurately reflects the arbitrary file write capability but may overstate practical risk due to exploitation prerequisites. The CVSS:4.0 vector shows PR:L (low-privilege authentication required) and AV:N (network vector), indicating remote exploitation by authenticated users-this is NOT an unauthenticated remote code execution scenario. Attack complexity is low (AC:L) once authenticated access exists. Critical missing signal: EPSS score unavailable, preventing probability-based prioritization. Not present in CISA KEV, suggesting no confirmed widespread or active exploitation in enterprise environments. However, GitHub PR #2274 provides technical details that could enable POC development. SSVC assessment: Exploitation=POC (technical details public), Automatable=No (requires authenticated session), Technical Impact=Partial (file write constrained by process permissions). Primary risk scenarios: (1) Compromised low-privilege accounts escalating impact through configuration file overwrites, (2) Malicious insiders tampering with ML pipeline configurations, (3) Supply chain attacks if DeerFlow instances are externally accessible. Risk is SIGNIFICANTLY LOWER if: DeerFlow is deployed internally with strong authentication, filesystem permissions restrict application process write access, or bootstrap-mode custom-agent creation is restricted to administrators only. Organizations should prioritize patching if DeerFlow is internet-facing or accessible to untrusted authenticated users.

An authenticated attacker with low-privilege access to a DeerFlow instance initiates custom-agent creation in bootstrap mode. Instead of a legitimate agent name like 'ml-pipeline-agent', the attacker supplies a traversal-style name such as '../../../etc/cron.d/malicious' or an absolute path like '/opt/deerflow/config/override.conf'. DeerFlow's insufficient validation accepts the malicious name, creating directories and writing files outside the intended custom-agent directory tree. The attacker overwrites a configuration file or injects a cron job, achieving persistence or privilege escalation depending on filesystem permissions. GitHub PR #2274 provides technical implementation details that could guide POC development.