CVE-2026-2096

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2096", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2026-02-06T11:02:47.826Z", "datePublished": "2026-02-10T06:59:35.738Z", "dateUpdated": "2026-02-10T19:34:51.774Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Agentflow", "vendor": "Flowring", "versions": [{"status": "affected", "version": "0"}]}], "datePublic": "2026-02-10T06:55:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality."}], "value": "Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2026-02-10T06:59:35.738Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-10699-49c0b-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-10700-3534d-2.html"}, {"tags": ["vendor-advisory", "mitigation"], "url": "https://forum.flowring.com/post/view?bid=72&id=45611&tpg=1&ppg=1&sty=1#45939"}], "source": {"advisory": "TVN-202606002", "discovery": "EXTERNAL"}, "title": "Flowring\uff5cAgentflow - Missing Authenticaton", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Please refer to the following official instructions and take the appropriate mitigation measures:<br><a target=\"_blank\" rel=\"nofollow\" href=\"https://forum.flowring.com/post/view?bid=72&amp;id=45611&amp;tpg=1&amp;ppg=1&amp;sty=1#45939\">https://forum.flowring.com/post/view?bid=72&amp;id=45611&amp;tpg=1&amp;ppg=1&amp;sty=1#45939</a><br><br>"}], "value": "Please refer to the following official instructions and take the appropriate mitigation measures:\n https://forum.flowring.com/post/view?bid=72&id=45611&tpg=1&ppg=1&sty=1#45939"}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T19:34:44.205621Z", "id": "CVE-2026-2096", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T19:34:51.774Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2096", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-10T19:34:44.205621Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T19:34:47.785Z"}}], "cna": {"title": "Flowring\uff5cAgentflow - Missing Authenticaton", "source": {"advisory": "TVN-202606002", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Flowring", "product": "Agentflow", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-10T06:55:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-10699-49c0b-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-10700-3534d-2.html", "tags": ["third-party-advisory"]}, {"url": "https://forum.flowring.com/post/view?bid=72&id=45611&tpg=1&ppg=1&sty=1#45939", "tags": ["vendor-advisory", "mitigation"]}], "workarounds": [{"lang": "en", "value": "Please refer to the following official instructions and take the appropriate mitigation measures:\n https://forum.flowring.com/post/view?bid=72&id=45611&tpg=1&ppg=1&sty=1#45939", "supportingMedia": [{"type": "text/html", "value": "Please refer to the following official instructions and take the appropriate mitigation measures:<br><a target=\"_blank\" rel=\"nofollow\" href=\"https://forum.flowring.com/post/view?bid=72&amp;id=45611&amp;tpg=1&amp;ppg=1&amp;sty=1#45939\">https://forum.flowring.com/post/view?bid=72&amp;id=45611&amp;tpg=1&amp;ppg=1&amp;sty=1#45939</a><br><br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality.", "supportingMedia": [{"type": "text/html", "value": "Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2026-02-10T06:59:35.738Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2096", "state": "PUBLISHED", "dateUpdated": "2026-02-10T19:34:51.774Z", "dateReserved": "2026-02-06T11:02:47.826Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2026-02-10T06:59:35.738Z", "assignerShortName": "twcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Agentflow", "vendor": "Flowring", "versions": [{"status": "affected", "version": "0"}]}], "source": "twcert@cert.org.tw"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:flowring:agentflow:-:*:*:*:*:*:*:*", "matchCriteriaId": "DD22355C-8F68-443E-9898-616A7C3EE2C3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality."}, {"lang": "es", "value": "Agentflow desarrollado por Flowring tiene una vulnerabilidad de autenticaci\u00f3n faltante, permitiendo a atacantes remotos no autenticados leer, modificar y eliminar contenidos de la base de datos mediante el uso de una funcionalidad espec\u00edfica."}], "id": "CVE-2026-2096", "lastModified": "2026-06-17T10:30:18.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "twcert@cert.org.tw", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "twcert@cert.org.tw", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2096", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T19:34:44.205621Z", "version": "2.0.3"}}]}, "published": "2026-02-10T07:16:14.110", "references": [{"source": "twcert@cert.org.tw", "tags": ["Vendor Advisory"], "url": "https://forum.flowring.com/post/view?bid=72&id=45611&tpg=1&ppg=1&sty=1#45939"}, {"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/en/cp-139-10700-3534d-2.html"}, {"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-10699-49c0b-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "twcert@cert.org.tw", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "product": "agentflow", "vendor": "flowring"}], "analysis": {"en": {"generated_at": "2026-04-17T20:53:11.872164+00:00", "value": {"mitigation_remediation": ["Apply the latest vendor patch or upgrade to a fixed version of Flowring Agentflow if available.", "Restrict network access to the Agentflow service, using firewalls or segmentation to limit exposure to trusted hosts.", "Follow the official Flowring workaround instructions provided in the forum post (https://forum.flowring.com/post/view?bid=72&id=45611&tpg=1&ppg=1&sty=1#45939)."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Data Manipulation"}, "threat_synthesis": {"affected_systems": "The affected product is Flowring Agentflow. No specific version information is provided in the data, so the scope of affected releases is currently unknown.", "description_and_impact": "Agentflow developed by Flowring has a Missing Authentication vulnerability that allows unauthenticated remote attackers to read, modify, and delete database contents by invoking a specific functionality. The flaw permits attackers to compromise confidentiality through data read, and integrity by altering or erasing data.", "risk_and_exploitability": "The CVSS score of 9.3 classifies this as a critical exposure, yet the EPSS score of less than 1% suggests that exploitation may be rare at present. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploitation. Based on the description, the likely attack vector is remote over the network via an exposed Agentflow endpoint; authenticated controls are missing, allowing any network\u2010connected adversary to execute the vulnerable functionality."}}}}, "created": "2026-02-10T11:34:28.440844+00:00", "updated": "2026-04-17T21:00:12.711456+00:00", "vendors": ["flowring", "flowring$PRODUCT$agentflow"]}