Which versions of Flowise are affected by CVE-2025-71336?

Flowise versions through 3.0.6 contain a critical remote code execution vulnerability enabling unauthenticated attackers to execute arbitrary OS commands and fully compromise the host container.. A patch is available.

How to fix or mitigate CVE-2025-71336?

24 hours: Enumerate all Flowise deployments (versions 2.2.7-patch.1 through pre-3.0.6) in production; assess network exposure and current authentication status; immediately isolate any internet-facing instances to internal-only access. 7 days: Disable the Custom MCP feature or implement strict IP-based network access controls (allowlist only trusted source IPs); enforce FLOWISE_USERNAME and FLOWISE_PASSWORD environment variables on all instances; deploy WAF/firewall rules to block POST requests to /api/v1/node-load-method/customMCP bearing 'x-request-from: internal' headers. 30 days: Monitor Flowise release notes for patched versions; plan and execute upgrade to version 3.0.6 or later once vendor releases a fix; conduct forensic review of instances that were exposed.

Flowise CVE-2025-71336

Q: What is the CVSS score of CVE-2025-71336?

CVE-2025-71336 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2025-210342 CRITICAL

OS Command Injection (CWE-78)

2026-06-25 VulnCheck

GHSA-q2xp-j85q-883h

Command Injection RCE Flowise

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Default no-auth install and attacker-set internal header make it remote and unauthenticated (PR:N, AC:L), and direct command execution yields full C/I/A loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 23:04 EUVD

Source Code Evidence Fetched

Jun 25, 2026 - 22:34 vuln.today

Analysis Generated

Jun 25, 2026 - 22:34 vuln.today

DescriptionCVE.org

Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless FLOWISE_USERNAME and FLOWISE_PASSWORD are set, an attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, resulting in complete compromise of the platform container or server.

AnalysisAI

Remote code execution in Flowise (versions 2.2.7-patch.1 through pre-3.0.6) lets attackers run arbitrary OS commands by abusing the Custom MCP feature, which is intended to spawn local MCP servers via tools like npx. Because the default installation runs with no authentication (unless FLOWISE_USERNAME/FLOWISE_PASSWORD are set) and lacks role-based access control, an attacker can POST a crafted JSON payload bearing the 'x-request-from: internal' header to /api/v1/node-load-method/customMCP and fully compromise the host container. Publicly available exploit code exists in the GHSA advisory, including a reverse-shell payload via nc.

Technical ContextAI

Flowise is a low-code/no-code visual builder for LLM orchestration flows. The vulnerability is an OS command injection (CWE-78) rooted in the Custom MCP node, which by design executes a configurable 'command' plus 'args' to launch Model Context Protocol servers. The customMCP node-load-method handler passes the user-supplied mcpServerConfig directly to a child-process invocation without sandboxing, allowlisting, or privilege separation. The 'x-request-from: internal' header is an internal trust marker the application honors, and combined with Flowise's minimal auth model (no RBAC, optional basic auth disabled by default per the affected CPE cpe:2.3:a:flowise:flowise:*) it allows the command/args fields to be set to any binary, e.g. touch, nc, /bin/sh.

RemediationAI

Upgrade to Flowise 3.0.6 or later (Vendor-released patch: 3.0.6); the fix is in PR https://github.com/FlowiseAI/Flowise/pull/5201 and commit ac7cf30e019cde54905bf09b5d3fe1c6ba42f9b9. If you cannot upgrade immediately, set FLOWISE_USERNAME and FLOWISE_PASSWORD to enable basic authentication and place the instance behind an authenticating reverse proxy, restrict network access to the /api/v1/node-load-method/customMCP endpoint, and where possible disable or remove the Custom MCP feature - accepting that doing so breaks legitimate local MCP server launching. Additionally, strip or reject the 'x-request-from: internal' header at the proxy layer so external clients cannot assert internal trust, run the Flowise container as a non-root, least-privilege user with no outbound network egress, and consider sandboxing Custom MCP execution as recommended in GHSA-6933-jpx5-q87q. Refer to the advisory at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6933-jpx5-q87q for vendor guidance.