Flowise CVE-2025-71336

Requires network reachability to the Flowise HTTP API and that the target is running an affected version (2.2.7-patch.1 through 3.0.6-pre) with the Custom MCP code path present. The decisive enabler is Flowise's default deployment with no authentication (FLOWISE_USERNAME/FLOWISE_PASSWORD unset) and no RBAC, so any client can call /api/v1/node-load-method/customMCP. The attacker must supply the 'x-request-from: internal' header and a JSON payload populating mcpServerConfig.command and mcpServerConfig.args with loadMethod 'listActions'. Limiting factors: instances configured with FLOWISE_USERNAME/FLOWISE_PASSWORD or an upstream auth proxy reduce unauthenticated exposure, and instances not exposed to attacker-reachable networks are out of reach; no user interaction is required and per CVSS PR:N no authentication is needed against default configurations.

All signals align toward high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) indicates remote, low-complexity, unauthenticated exploitation with full confidentiality, integrity and availability loss on the vulnerable system - and a working PoC plus reverse-shell technique are public, raising automatability. The 'x-request-from: internal' header is trivially attacker-controlled, removing any meaningful barrier. The main limiting factor is the default-no-auth deployment assumption: if an operator has set FLOWISE_USERNAME/FLOWISE_PASSWORD or fronted Flowise with an auth proxy, the unauthenticated attack surface narrows, though the PoC does not demonstrate that auth blocks the internal header path, so this should be verified against a hardened instance. No EPSS score and no CISA KEV listing were provided in the input, so widespread active exploitation is not confirmed; risk is driven by public PoC plus the trivial preconditions rather than observed in-the-wild campaigns.

An attacker discovers an internet-exposed Flowise instance running with its default no-auth configuration, then sends a single POST to /api/v1/node-load-method/customMCP with the 'x-request-from: internal' header and a JSON body setting command to 'nc' with args pointing at the attacker's listener and '-e /bin/sh'. Flowise spawns the process, granting an interactive reverse shell as the Flowise service user and full control of the container. A public PoC demonstrating both a file-creation proof and the reverse shell is included in the GHSA advisory.