Skip to main content

Flowise CVE-2026-58057

| EUVDEUVD-2026-39977 LOW
Improper Handling of Case Sensitivity (CWE-178)
2026-06-28 VulnCheck GHSA-rqqr-m697-6jq3
Microsoft RCE Flowise
2.3
CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY
2.3 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.5 HIGH

Network vector for remote authenticated user; AC:H for Windows-only platform plus opt-in stdio requirement; PR:L for authenticated user; scope changed as injected code executes in server OS process.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

6
Patch available
Jun 28, 2026 - 03:01 EUVD
Source Code Evidence Fetched
Jun 28, 2026 - 02:29 vuln.today
Analysis Generated
Jun 28, 2026 - 02:29 vuln.today
Severity Changed
Jun 28, 2026 - 02:22 NVD
MEDIUM LOW
CVSS changed
Jun 28, 2026 - 02:22 NVD
5.0 (MEDIUM) 2.3 (LOW)
CVE Published
Jun 28, 2026 - 01:32 cve.org
LOW 2.3

DescriptionCVE.org

Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, where environment names are case-insensitive, supplying 'node_options' bypasses the NODE_OPTIONS denylist entry. An authenticated user who can configure a Custom MCP node can thereby inject NODE_OPTIONS --require and execute arbitrary code in the Flowise server context.

AnalysisAI

Arbitrary code execution in Flowise before 3.1.3 on Windows allows an authenticated user with Custom MCP node configuration access to bypass the NODE_OPTIONS environment variable denylist by supplying the lowercase variant 'node_options', exploiting a case-sensitive string comparison against a case-insensitive OS. The injected NODE_OPTIONS --require directive causes the Flowise server process to load an attacker-controlled module when spawning a Custom MCP stdio child process. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Authenticate to Flowise as low-privilege user
Delivery
Access Custom MCP node configuration panel
Exploit
Submit 'node_options' env var with --require payload to bypass denylist
Install
Server spawns stdio MCP child process with injected env var
C2
Windows resolves 'node_options' as NODE_OPTIONS at OS level
Execute
Node.js loads attacker's module in Flowise server context
Impact
Execute arbitrary code with server process privileges
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Three specific conditions must all be true simultaneously: (1) Flowise must be running on a Windows operating system, since the bypass depends entirely on Windows treating 'node_options' and 'NODE_OPTIONS' as the same variable while the denylist code treats them as different strings; Linux and macOS deployments are not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 4.0 base score of 2.3 significantly understates the real-world impact when exploitation conditions are met. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated Flowise user on a Windows-hosted instance navigates to a Custom MCP stdio node configuration and sets an environment variable named 'node_options' (lowercase) with the value '--require /tmp/malicious.js', where the payload file is accessible to the server process. Because the denylist check compares 'node_options' against 'NODE_OPTIONS' with case-sensitive logic, the check passes, and the server spawns the stdio child process with the injected variable - which Windows resolves identically to NODE_OPTIONS - causing Node.js to load and execute the attacker's module within the Flowise server process context. …
Remediation Vendor-released patch: Flowise 3.1.3. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Flowise

View all
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2025-8943 CRITICAL POC
9.8 Aug 14

Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
CVE-2025-26319 CRITICAL POC
9.8 Mar 04

FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
CVE-2025-58434 CRITICAL POC
9.8 Sep 12

Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
CVE-2026-30821 CRITICAL POC
9.8 Mar 07

Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
CVE-2026-30824 CRITICAL POC
9.8 Mar 07

Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
CVE-2026-56274 HIGH POC
8.7 Jun 23

Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
CVE-2026-30820 HIGH POC
8.8 Mar 07

Privilege escalation in Flowise versions prior to 3.0.13 allows authenticated users to bypass API authorization by spoof
CVE-2026-30823 HIGH POC
8.8 Mar 07

Flowise versions up to 3.0.13 is affected by authorization bypass through user-controlled key (CVSS 8.8).
CVE-2025-34267 HIGH POC
8.4 Oct 14

Authenticated remote code execution in FlowiseAI Flowise (v3.0.1 up to but not including 3.0.8, and later versions when

CVE-2024-8181 HIGH POC
8.1 Aug 27

An Authentication Bypass vulnerability exists in Flowise version 1.8.2. Rated high severity (CVSS 8.1), this vulnerabili
CVE-2026-30822 HIGH POC
7.7 Mar 07

Flowise versions up to 3.0.13 is affected by improperly controlled modification of dynamically-determined object attribu

Same weakness CWE-178 – Improper Handling of Case Sensitivity

View all
CVE-2025-27636 MEDIUM POC
5.6
CVE-2021-24347 HIGH POC
8.8
CVE-2024-5699 CRITICAL POC
9.8
CVE-2023-3545 CRITICAL POC
9.8
CVE-2018-9845 CRITICAL POC
9.8
CVE-2026-27588 CRITICAL POC
9.1
CVE-2026-27587 CRITICAL POC
9.1
CVE-2020-12812 CRITICAL
9.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2026-58057 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy