FlowCI Vulnerability Exposes CI/CD Systems to Remote Code Injection (CVE-2026-124328)
A newly disclosed security vulnerability in FlowCI could allow attackers to execute malicious code through its Groovy script evaluation functionality. The vulnerability, tracked as CVE-2026-124328, affects FlowCI’s flow-core-x component and could put development environments and the systems connected to them at risk.
Published on 8 November 2026, the vulnerability involves insufficient protection of user-supplied input processed by the platform’s condition evaluation functionality. Security researchers have classified the issue as a code injection vulnerability, with remote exploitation reported as possible.
What is CVE-2026-124328?
CVE-2026-124328 affects FlowCI flow-core-x versions up to and including 1.23.49.
The security weakness exists within the ConditionManagerImpl.run function, located in:
core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java
The affected component is responsible for evaluating conditions using Groovy scripting. According to the vulnerability disclosure, manipulating the condition argument can result in code injection.
The underlying problem is that input supplied to the condition evaluation process is not adequately neutralised before being passed to the Groovy scripting environment.
This creates an opportunity for an attacker to introduce specially crafted input that may be interpreted as executable code rather than ordinary condition data.
Potential impact on organisations
FlowCI is a continuous integration and continuous delivery (CI/CD) platform used to automate software development workflows.
CI/CD platforms are particularly attractive targets for attackers because they frequently have access to source code repositories, build environments, deployment credentials and other sensitive infrastructure.
If successfully exploited, CVE-2026-124328 could potentially allow an attacker to execute unauthorised code within the affected environment.
Depending on the permissions available to the compromised FlowCI process, the consequences could include:
- Unauthorised access to source code and development resources.
- Modification of build processes and deployment pipelines.
- Theft of credentials and sensitive configuration information.
- Manipulation of software builds and deployment activities.
- Disruption of development and delivery services.
- Potential access to connected systems and infrastructure.
The actual impact would depend on how FlowCI is deployed, the permissions assigned to its processes and the level of access available to an attacker.
Vulnerability severity and exploitation
The vulnerability has received a CVSS 3.1 base score of 7.4, placing it in the High severity category.
The associated CVSS 3.1 vector is:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Several characteristics make the vulnerability particularly concerning. It can reportedly be exploited remotely, requires low attack complexity and does not require interaction from another user.
However, the CVSS assessment indicates that an attacker must already possess some level of privileges to exploit the vulnerability.
The vulnerability has also been assigned a CVSS 4.0 score of 5.3, classified as Medium. The difference reflects the separate scoring methodologies used by the two CVSS versions.
Importantly, the published vulnerability information states that exploit details have been made publicly available and that exploitation may be possible. This does not, by itself, confirm that attacks are currently taking place in the wild.
What should administrators do?
Organisations running FlowCI should establish whether they are using an affected version of flow-core-x.
The published vulnerability information identifies versions 1.23.0 through 1.23.49 as affected. At the time of writing, the available disclosure does not identify a confirmed fixed release.
Recommended precautions include:
- Check deployed FlowCI versions and identify installations running flow-core-x 1.23.49 or earlier.
- Monitor FlowCI’s official project channels for security updates and remediation guidance.
- Restrict access to FlowCI administration interfaces to trusted users and networks.
- Review user permissions, particularly accounts able to configure or modify CI/CD conditions.
- Examine application logs for unusual condition evaluations or unexpected Groovy script execution.
- Review build pipelines and deployment activity for suspicious changes.
Where possible, organisations should temporarily restrict access to affected functionality until a verified fix becomes available.
Administrators should avoid assuming that simply upgrading beyond version 1.23.49 resolves the issue without confirmation from the vendor or a verified security patch.
Vendor response and disclosure
The vulnerability record states that the vendor was contacted before the disclosure but did not respond.
The issue was subsequently published on 8 November 2026, with technical information made publicly available. The disclosure also references research describing unrestricted GroovyShell execution within FlowCI’s CI condition evaluation process.
The absence of a confirmed vendor response or published remediation makes it particularly important for organisations using the affected software to monitor developments.
Conclusion
CVE-2026-124328 highlights the security risks associated with allowing externally influenced input to reach scripting engines without adequate validation and restrictions.
CI/CD platforms often operate with access to sensitive development resources and deployment infrastructure, making vulnerabilities in these environments particularly important to address.
Although exploitation requires some level of existing privileges, the reported ability to execute code remotely makes this a vulnerability that FlowCI administrators should investigate promptly.
Organisations should review their installations, restrict unnecessary access and monitor for vendor guidance as further information becomes available.
Vulnerability details
- CVE: CVE-2026-124328
- Vendor: FlowCI
- Product: flow-core-x
- Affected versions: 1.23.0 – 1.23.49
- Vulnerability type: Code Injection
- CWE: CWE-94 / CWE-74
- CVSS 3.1: 7.4 (High)
- CVSS 4.0: 5.3 (Medium)
- Published: 8 November 2026
- Public exploit information: Reported
Further information: Tenable – CVE-2026-124328
Additional references: NVD | EUVD
Sources: Tenable, NVD and BaseFortify. Tenable®+2
I am one of the editors here at www.systemtek.co.uk I am a UK based technology professional, with an interest in computer security and telecoms.