Read the docs
TI-2026-24839 Aliases CVE-2026-32311

Command Injection and Docker container escape allows root on host machine

Priority HIGH 81CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. The nodes can have automated processes execute on them called 'transformers'. A remote attacker can create a sketch, then trigger the 'org_to_asn' transform on an organization node to execute arbitrary OS commands as root on the host machine via shell metacharacters and a docker container escape. Commit b52cbbb904c8013b74308d58af88bc7dbb1b055c appears to remove the code that causes this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00506 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
reconurgeflowsint< b52cbbb904c8013b74308d58af88bc7dbb1b055c—No fix listedCNA
  • flowsint Vendorreconurge Affected < b52cbbb904c8013b74308d58af88bc7dbb1b055c Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:flowsint:flowsint:-:*:*:*:*:*:*:*not specified by NVDVulnerableFlowsint
  • cpe:2.3:a:flowsint:flowsint:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Flowsint

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32311
  2. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

  • TI-2026-30485 Flowsint: Cypher query injection in node type on node creation CVSS 4.0HIGH 7.1
  • TI-2026-32317 Flowsint: Broken Access Control allows reading of sketch logs from any user CVSS 4.0MEDIUM 5.3
  • TI-2026-30486 Flowsint: Stored XSS on map node marker in map page CVSS 4.0MEDIUM 5.1
  • TI-2026-30487 Flowsint: Broken Access Control allows modification of investigation metadata from any user CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences