Flowise CVE-2026-69263

The Custom MCP node must be accessible, and the attacker must be able to submit a Custom MCP stdio server configuration with attacker-controlled environment variables. On default Flowise deployments (authentication is disabled out of the box), this requires only network access to the Flowise HTTP API - no credentials or prior session are needed. The stdio transport path was reachable by default in affected versions whenever a command field was provided in the MCP config; no special deployment flag was required. The CUSTOM_MCP_SECURITY_CHECK=true setting does not block this bypass - the attack works specifically because the security check's environment variable validation uses an incomplete denylist. Exploitation is prevented if: Flowise authentication is enabled and the attacker lacks valid credentials; the deployment explicitly sets CUSTOM_MCP_PROTOCOL=sse (disabling stdio transport); or network access to the Flowise API is restricted to trusted users. The vulnerability does not require any specific OS platform or database backend.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects a network-accessible, low-complexity vulnerability with high impact across confidentiality, integrity, and availability. The PR:L metric warrants scrutiny: the GHSA advisory explicitly labels this 'Unauthenticated RCE' because Flowise ships with authentication disabled by default, meaning 'low privileges' in practice equates to any network-accessible API call on a default deployment. EPSS data was not provided in the input, so exploitation probability cannot be quantified. KEV status is not confirmed - no CISA KEV listing was present in the source data. No public exploit code has been identified at time of analysis, but the bypass technique is straightforward and completely described in the public GHSA advisory, making CISA KEV listing and rapid exploitation plausible. The structural severity is compounded by the patch bypass nature: organizations that applied the CVE-2025-8943 fix and considered themselves protected remain fully vulnerable on 3.1.1 and 3.1.2. The fix is architecturally sound - switching from denylist to allowlist eliminates the entire class of bypass - but urgency to upgrade is high for any internet-exposed Flowise instance.

An attacker targets an internet-exposed Flowise 3.1.2 instance running with default settings (no authentication). Using the Flowise API, the attacker creates a Custom MCP flow node configured with npx as the command, a malicious npm package name as the argument, and npm_config_yes=true set in the environment variables map. When the flow is triggered, Flowise's validateEnvironmentVariables passes npm_config_yes through unchecked (it is not in the four-item denylist), npx silently installs the attacker-specified package without prompting, and the package executes arbitrary code as the Flowise server process - granting full control over the host. The bypass technique is entirely derivable from the published GHSA advisory without additional research.