CVE-2026-41274 is a critical injection flaw (CVSS 9.8) in the Flowise GraphCypherQAChain node. Before 3.1.0, user input goes into the Cypher query pipeline without sanitization, so an attacker can read, change or delete data in the connected Neo4j database. Fixed in 3.1.0.
What's affected
The GitHub advisory lists the npm packages flowise and flowise-components at 3.0.13 and earlier, with 3.1.0 as the patched version. Only chatflows that use the GraphCypherQAChain node and a Neo4j database are in scope.
How to check if you're exposed
npm ls flowise flowise-components
For containers, check the image tag. Then list the flows that use the GraphCypherQAChain node and note which Neo4j database and account each one connects to. The account's privileges decide the damage: a read-only user limits an attacker to reading, while an admin user can change or drop data.
What to do now
- Upgrade Flowise to 3.1.0 or later.
- Give each Flowise flow a dedicated Neo4j user with the least privileges it needs, ideally read-only.
- Disable public access to flows that touch sensitive graph data until you have upgraded.
- Review Neo4j query logs for statements you do not recognise.
- Take a backup of graph data before any cleanup so you can compare later.
Why it matters
The record lists CWE-943, improper neutralization of special elements in a data query logic. It is the graph database cousin of SQL injection.
The advisory says the node forwards user input into query execution without sanitization. In an LLM chain, the user's words are turned into a query, often by the model itself, so input control and query control blur together. Treat model written queries as untrusted, run them with a low privilege account and prefer parameterized, fixed query shapes where you can. The record does not flag this CVE as known exploited.
Quick check
Does a read-only Neo4j user make this safe?
It limits the damage to reading, which can still expose sensitive data. Upgrade as well.
Sources
Last reviewed: 19 October 2026.
