What is the CVSS score of CVE-2026-41268?

CVE-2026-41268 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Flowise are affected by CVE-2026-41268?

Flowise AI orchestration platform versions before 3.1.0 are vulnerable to unauthenticated attacks that grant attackers complete control of containerized infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-41268?

Within 24 hours, immediately patch all Flowise installations to version 3.1.0 or later, or isolate affected systems from production networks if immediate patching is not feasible. Within 7 days, verify patch deployment across all Flowise instances in your environment, review container and system logs for suspicious command execution dating back 30 days to detect potential exploitation, and confirm no unauthorized access occurred. Within 30 days, conduct full security assessment of systems that ran vulnerable Flowise versions, rotate any credentials or API keys that may have been exposed during the vulnerable window, and implement network segmentation to limit blast radius of future container compromises.

Flowise CVE-2026-41268

EUVD-2026-25285 CRITICAL

Improper Input Validation (CWE-20)

2026-04-23 GitHub_M

GHSA-cvrr-qhgw-2mm6

Authentication Bypass Flowise

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Single unauthenticated HTTP request (AV:N/AC:L/PR:N/UI:N) yields root command execution in-container with total confidentiality, integrity and availability impact; scope unchanged as no other system is compromised.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:33 vuln.today

Analysis Generated

Jul 24, 2026 - 04:33 vuln.today

Severity Changed

Apr 24, 2026 - 15:22 NVD

HIGH CRITICAL

CVSS changed

Apr 24, 2026 - 15:22 NVD

7.7 (HIGH) 9.8 (CRITICAL)

Patch released

Apr 24, 2026 - 15:14 nvd

Patch available

Apr 23, 2026 - 21:01 EUVD

EUVD ID Assigned

Apr 23, 2026 - 20:00 euvd

EUVD-2026-25285

CVE Published

Apr 23, 2026 - 19:13 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODE_OPTIONS environment variable injection. This allows for the execution of arbitrary system commands with root privileges within the containerized Flowise instance, requiring only a single HTTP request and no authentication or knowledge of the instance. This vulnerability is fixed in 3.1.0.

AnalysisAI

Remote code execution in Flowise before 3.1.0 lets an unauthenticated attacker run arbitrary OS commands as root inside the container with a single HTTP request. The flaw chains a parameter-override validation bypass (the FILE-STORAGE:: keyword check) with NODE_OPTIONS environment-variable injection through the Custom MCP node. Publicly available exploit code exists per the SSVC 'poc' rating, though EPSS is only 0.17%; no active exploitation has been confirmed.

Technical ContextAI

Flowise is a Node.js/TypeScript low-code platform for building LLM orchestration flows. The root cause is CWE-20 (Improper Input Validation) in the replaceInputsWithConfig function in packages/server/src/utils/index.ts: a guard meant to permit file-type overrides tests overrideConfig[config].includes('FILE-STORAGE::') using .includes() rather than .startsWith(), so the keyword can appear anywhere in a string (even inside a /* comment */) to satisfy the check. The guard performs no parameter-type validation, so it applies to any parameter name including mcpServerConfig, and when it passes it skips isParameterEnabled() entirely - allowing override of parameters administrators never exposed. The injected mcpServerConfig reaches the Custom MCP node (packages/components/nodes/tools/MCP/core.ts), whose dangerous-env blocklist covers only PATH, LD_LIBRARY_PATH and DYLD_LIBRARY_PATH but not NODE_OPTIONS, so an attacker sets NODE_OPTIONS=--experimental-loader to execute attacker-controlled JavaScript before the main process starts. Affected CPE is cpe:2.3:a:flowiseai:flowise (npm packages flowise and flowise-components <= 3.0.13).

RemediationAI

Vendor-released patch: upgrade Flowise (and flowise-components) to 3.1.0 or later, which fixes both the FILE-STORAGE:: bypass and the NODE_OPTIONS injection; see GHSA-cvrr-qhgw-2mm6 (https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cvrr-qhgw-2mm6). If you cannot upgrade immediately, remove the instance from public exposure and place it behind authenticated access or a VPN, since the attack needs only a single unauthenticated HTTP request; disable the API override feature so external overrideConfig values are not applied (this breaks any workflow relying on runtime parameter overrides); and avoid or restrict the Custom MCP node, which is the sink for the NODE_OPTIONS injection (this disables MCP tool functionality). As container hardening that limits blast radius rather than closing the flaw, run the container as a non-root user with a least-privilege/read-only filesystem. These are compensating controls only - patching to 3.1.0 is the definitive fix.