Flowise CVE-2026-73601

Requires an authenticated Flowise account (CVSS PR:L) with the ability to configure or run a Custom MCP node, AND the deployment must have CUSTOM_MCP_PROTOCOL set to stdio - this is the specific configuration prerequisite reflected by AT:P in the vector. Concretely, the attacker abuses the PYTHONWARNINGS and BROWSER environment variables passed to python3, or exploits node executing from the unrestricted root working directory, to bypass argument/env validation. Limiting factors: exploitation is not possible against default deployments that do not use the stdio protocol, requires valid low-level credentials (not fully unauthenticated), and depends on python3/node being available on the host; no user interaction by a victim is needed (UI:N).

The signals broadly agree this is a real, high-priority issue for exposed instances, but with an important gating condition. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N, full VC/VI/VA and SC/SI/SA High) scores 9.0: network-reachable, low complexity, but requiring an attack precondition (AT:P) and low-level authentication (PR:L). The AT:P and the description together confirm exploitation depends on the non-default stdio protocol configuration, which tempers the raw network-RCE picture. No EPSS score, KEV listing, or POC flag was supplied in the input, so exploitation probability cannot be quantified and there is no evidence of active or automated exploitation. Net assessment: genuine high risk for organizations that expose Flowise to untrusted authenticated users AND run Custom MCP nodes in stdio mode; lower practical risk for default deployments not using stdio. The absence of KEV/EPSS/POC data is a gap - treat the priority as configuration-dependent rather than universally critical.

An attacker with a low-privileged authenticated Flowise account opens a flow using a Custom MCP node configured with the stdio protocol and supplies a python3 command whose PYTHONWARNINGS (or BROWSER) environment variable embeds a coded directive that Python evaluates on startup, or points node at a script via the unrestricted root working directory. When the node executes, the crafted directive bypasses validation and runs arbitrary OS commands on the Flowise host under the service account. No public exploit is identified at time of analysis, but the abuse technique is described concretely in the advisories.