CVE-2026-2095

Executive Summary

CVE-2026-2095 is a critical authentication bypass vulnerability in Flowring Agentflow, a business process management (BPM) platform widely deployed in enterprise environments across the Asia-Pacific region. The flaw allows unauthenticated remote attackers to invoke a specific functionality that returns arbitrary user authentication tokens, enabling complete account takeover of any user, including administrative accounts. With a CVSS score of 9.3, this vulnerability represents an immediate and severe threat to organizations running Agentflow, as exploitation requires no credentials, no user interaction, and can be executed remotely over the network.

Technical Analysis

Agentflow is a Java-based BPM/workflow system developed by Flowring (a Taiwan-based software vendor). The authentication bypass originates from a flaw in the session token generation and validation logic. The vulnerable functionality is exposed through the application's servlet/controller layer, which fails to enforce proper authentication checks before processing requests to a specific API endpoint.

Vulnerability Mechanism:

1. Token Generation Flaw: The application contains an exposed method that generates authentication tokens based on predictable or user-controlled parameters, such as user ID, rather than requiring a valid session or credential. This method is likely part of the password-reset, session-recovery, or single-sign-on (SSO) integration logic.
2. Missing Access Control: The endpoint responsible for token issuance lacks a servlet filter or interceptor that validates the caller's identity. In Java EE applications, this typically manifests as a missing @RolesAllowed annotation, absent security constraints in web.xml, or a faulty doGet/doPost handler that bypasses the authentication chain.
3. Token Submission: Once a token is obtained, the attacker submits it via a session-cookie update, request header, or URL parameter — depending on how Agentflow manages session state (likely via JSESSIONID or a custom cookie).

Attack Surface:

• The vulnerable endpoint is typically exposed on the main web application port (commonly 80/443, or a dedicated application port such as 8080/8081).
• Agentflow is often deployed on Windows Server or Linux with Tomcat as the servlet container, making the servlet mapping path predictable.
• The authentication bypass does not require prior access to any valid account, and there is no evidence of access restrictions (IP allowlisting) in the default deployment.

CVSS Vector Note: The official vector is listed as UNKNOWN, but based on the CNA description, the score of 9.3 is consistent with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Network, Low complexity, No privileges, No user interaction, Unchanged scope, High confidentiality/integrity/availability).

Exploitation Scenarios

The following is a concrete attack chain, based on the vulnerability class (authentication token retrieval) rather than a public PoC, which has not been confirmed:

Step 1 — Reconnaissance and Target Identification: The attacker performs a Shodan/Censys search for exposed Agentflow instances using a dork such as http.title:"Agentflow" or by fingerprinting the login page HTTP headers (Server: Apache-Coyote/1.1, X-Powered-By: JSP/2.3). The next stage is identifying the exact application version. This is usually visible in the footer of the login page or in the URL path, e.g., /agentflow/version.jsp. Attackers also probe for default installation paths like /agentflow, /flowring, or /AF.

Step 2 — Trigger the Token-Endpoint: The attacker sends an unauthenticated HTTP request to the identified token-issuance endpoint. Based on the controller naming convention in Java BPM products, a realistic target would be:

GET /agentflow/rest/api/auth/token?userID=admin&callbackUrl=/index.jsp

Alternatively, a servlet endpoint:

POST /agentflow/session/impersonate.jsp
Content-Type: application/x-www-form-urlencoded
username=administrator&reason=passwordReset

The request requires no session cookie. The server responds with a JSON or HTTP parameter containing the authentication token for the requested user ID. Because the endpoint is unauthenticated, the server accepts the request without validating the caller.

Step 3 — Session Manipulation and Authentication: The attacker extracts the token from the response, e.g., {"token":"a1b2c3d4e5f6..."}. They then forge an HTTP request to the main application endpoint, including the token in the Authorization: Bearer header, in a custom cookie (AF_TOKEN), or as a URL parameter ?token=...:

GET /agentflow/main.jsp HTTP/1.1
Host: target.victim.com
Cookie: JSESSIONID=<attacker's_original_id>; AF_TOKEN=a1b2c3d4e5f6...

The server validates the token against its session cache and grants the attacker a fully authenticated session for the specified user.

Step 4 — Post-Exploitation: The attacker logs in as administrator. From there, typical BPM post-exploitation actions include:

• Downloading/exporting all business process definitions and attached documents (data exfiltration).
• Modifying approval workflows to bypass mandatory approval steps for financial transactions (integrity destruction).
• Uploading a crafted Java class/JSP file through the system's plugin or form-design functionality to achieve Remote Code Execution (RCE) on the underlying application server.
• Extracting database credentials from configuration files to move laterally into the internal network.

Impact Assessment

Severity: Critical (CVSS 9.3)

Business Impact:

• Confidentiality (High): An attacker can impersonate any user, including executives, legal, finance, or system administrators, to extract sensitive business process data, personally identifiable information (PII), and intellectual property.
• Integrity (High): Attackers can modify workflow definitions, alter approval chains, and tamper with audit trails, potentially approving fraudulent payments or bypassing compliance controls.
• Availability (High): An attacker with admin access can delete workflows, corrupt database tables, or leverage the RCE primitive to shut down the server.

Affected Systems: All versions of Agentflow that have not received the vendor's workaround (see mitigation section). The vendor advisory suggests a configuration change, implying the vulnerability exists in deployments lacking a specific filter or reverse-proxy rule.

Blast Radius: Agentflow is a business-critical system integrating with human resource management, procurement, and financial systems. Compromise of a single Agentflow instance can lead to full network compromise if the application server resides inside the corporate perimeter without segmentation (common in legacy on-premise deployments). The low EPSS score (0.00507) suggests it is not yet actively exploited in the wild, but it is a high-value target for APT groups and ransomware operators due to the privileged nature of BPM systems in Asia-Pacific enterprises.

Detection Guidance

Sigma Rule

title: Suspicious Unauthenticated Token Request to Flowring Agentflow
id: 9e4bda51-2b78-4a32-8f76-6f9b5e2d8f8a
status: experimental
description: Detects requests targeting Agentflow authentication token endpoints without valid session cookies.
author: ValtersIT Threat Intelligence Team
date: 2026/05/20
logsource:
  category: webserver
  product: apache
  service: access-log
detection:
  selection_token_endpoint:
    cs-method:
      - 'GET'
      - 'POST'
    cs-uri-query:
      - '*token*'
      - '*impersonate*'
      - '*getAuth*'
      - '*resetAuthToken*'
    cs-uri-query|contains:
      - 'userID='
      - 'username='
      - 'user_id='
  selection_no_cookie:
    cs-uri-query|endswith: '.jsp'
    cs(user-agent): 'Mozilla/5.0'
  filter_known_browsers:
    cs(referer): '*login*'
  condition: selection_token_endpoint and selection_no_cookie and not filter_known_browsers
level: high
falsepositives:
  - Misconfigured monitoring / uptime checks
  - Admin password reset functionality (if accessible externally)
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.2095

YARA Rule

rule CVE_2026_2095_Agentflow_AuthBypass
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects exploit strings targeting Flowring Agentflow auth bypass"
        date = "2026-05-20"
        cve = "CVE-2026-2095"
        severity = "critical"
    strings:
        $s1 = "token" nocase
        $s2 = "userID" nocase
        $s3 = "impersonate" nocase
        $s4 = "agentflow" nocase
        $s5 = "generateToken" nocase
        $s6 = "resetAuth" nocase
        $s7 = ".jsp" nocase
        $a1 = "Authorization: Bearer" ascii
        $a2 = "AF_TOKEN" ascii
    condition:
        (
            uint16(0) == 0x0D0A or
            filesize < 50KB
        ) and
        any of ($s*) and
        (
            $a1 at any offset or
            $a2 at any offset
        ) and
        // Heuristic: URL param 'userID' paired with 'token' without session pattern
        #s1 > 0 and #s2 > 0 and #s4 > 0
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Flowring Agentflow Unauthenticated Token Retrieval Attempt (CVE-2026-2095)";
    flow:established,to_server;
    http.uri;
    content:"/agentflow/"; depth:12;
    content:"token"; nocase;
    pcre:"/(?:userID|username|user_id)=[\w%\-.]+[^\s&]*/Ui";
    pcre:"/(?:generateToken|impersonate|getAuthToken)/Ui";
    classtype:attempted-admin;
    sid:1002095;
    rev:1;
    metadata:created_at 2026_05_20, updated_at 2026_05_20, cve CVE_2026_2095;
)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=5m
  [ network where network.protocol == "http" and
    http.request.method in ("GET", "POST") and
    url.path like "*/agentflow/*" and
    (url.path like "*token*" or url.path like "*impersonate*" or url.path like "*getAuth*")
  ] 
  [ network where network.protocol == "http" and
    http.response.status_code == 200 and
    http.response.body like "*token*"
  ]

Splunk SPL Query

index=web earliest=-7d
| where `is_web_request` 
| search uri_path="*/agentflow/*" 
  AND (uri_path="*token*" OR uri_path="*impersonate*" OR uri_path="*getAuth*")
| eval hasUserParam=if(uri_query LIKE "%userID=%" OR uri_query LIKE "%username=%" OR uri_query LIKE "%user_id=%", "yes", "no")
| eval hasTokenResponse=if(status=200 AND (response_body LIKE "%token%" OR response_body LIKE "%session_id%"), "yes", "no")
| where hasUserParam="yes"
| stats count min(_time) as firstSeen max(_time) as lastSeen by src_ip, uri_path, hasTokenResponse
| sort count desc
| table _time src_ip uri_path uri_query count hasTokenResponse

Wazuh OSSEC Rule

<group name="web,agentflow,">
  <rule id="100295" level="15">
    <decoded>agentflow_token_post</decoded>
    <match>userID=|username=|user_id=</match>
    <regex>\/agentflow\/.*(token|impersonate|getAuth)</regex>
    <description>Possible exploitation of CVE-2026-2095 - Flowring Agentflow authentication bypass attempt detected from $(srcip)</description>
    <group>authentication_failures,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 1/4 — PARTIAL. The official vendor advisory (referenced in the CVE metadata) describes workaround/mitigation instructions but the existence of a complete official fix is not confirmed at the time of this report.

1. Immediate Mitigations (Do these now):

• Apply vendor workaround immediately: Follow the official instructions at https://forum.flowring.com/post/view?bid=72&id=45611&tpg=1&ppg=1&sty=1#45939. Based on the advisory, this likely involves deploying or updating a web application firewall (WAF) rule, or modifying the Tomcat web.xml to add a security constraint that blocks unauthenticated access to the vulnerable servlet/controller paths.
• Restrict network access: Limit access to the Agentflow web application to trusted office IP ranges via firewall or security group rules, and deny external access to any paths containing /token, /impersonate, or /getAuth — unless strictly required, in which case apply strong multi-factor authentication at the reverse proxy layer.
• Enable WAF virtual patching: If you have a WAF (ModSecurity, AWS WAF, F5, Imperva), deploy a virtual patch rule that blocks requests to the vulnerable endpoint when no valid session cookie (JSESSIONID that matches an active session) is present.

2. Patch/Upgrade Steps:

• Since a confirmed software patch is not yet listed, check the Flowring vendor forum and support portal daily. Subscribe to the advisory thread. When a patched version is released, upgrade Agentflow to the fixed version as follows:
  1. Back up the application configuration and database.
  2. Download the patched build from the vendor's authorized channel.
  3. Schedule a maintenance window. Stop the application server (Tomcat).
  4. Replace the WAR file / application directory, preserving the application.properties and db.properties files.
  5. Restart and run a health check.

3. Long-Term Hardening:

• User Account Hygiene: Immediately enable mandatory periodic password resets for admin accounts and enforce MFA for all privileged users. Monitor for token reuse anomalies in application logs.
• Network Segmentation: Place the Agentflow server in a dedicated application tier behind a reverse proxy (nginx or IIS ARR). The proxy should be the only entry point and should terminate TLS and enforce strict path-based access control.
• Harden the Java stack: Apply the latest security updates for the underlying Tomcat and JVM. By default, ensure the COPYJSP / view-source servlets are commented out, and remove unused Agentflow plugins/modules.
• Logging & Monitoring: Ensure Agentflow application logs (catalina.out, access_log) are shipped to a central SIEM. Alert on any successful login from a new IP to an admin account, and any login where the session token was received via an URL parameter rather than a cookie.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-2095
2. Vendor Workaround Advisory (Flowring Forum): https://forum.flowring.com/post/view?bid=72&id=45611&tpg=1&ppg=1&sty=1#45939
3. TWCERT CVE Coordination Notice: https://www.twcert.org.tw/en/cp-4-xxxx-CVE-2026-2095.html (expected mirror of CNA assignment)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not yet listed — as of report date)
5. EPSS Data (FIRST.org): https://www.first.org/epss/ (score 0.00507, 40.5th percentile)

Threat Actor Campaign Evidence: As of this report's publication, there are no confirmed exploit-in-the-wild campaigns or CISA KEV listing for this CVE. The EPSS score of 0.00507 reflects low immediate exploitation probability. However, given the history of similar BPM authentication bypass vulnerabilities (e.g., previous Agentflow CVEs, and analogous issues in other Taiwanese BPM vendors), threat actors focusing on the APAC region and supply-chain attacks against manufacturing sectors are likely to weaponize this within 30-60 days once a public PoC emerges. Security teams should proactively implement detection rules and mitigations immediately despite the absence of active exploitation.