Which versions of Flowise are affected by EUVD-2026-38434?

Flowise before 3.1.2 contains a remote code execution vulnerability affecting authenticated users and API callers with chatflow permissions, allowing complete host compromise through an incomplete…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-38434?

Yes, a public proof-of-concept exploit is available for EUVD-2026-38434. Prioritise patching immediately. EPSS: 1.7%.

How to fix or mitigate EUVD-2026-38434?

Within 24 hours: Identify all Flowise deployments and determine current versions; review recent authentication logs and API access for signs of exploitation; isolate any instances exposed to untrusted networks. Within 7 days: Disable the Custom MCP Server feature if not actively required; restrict access to Flowise admin interfaces to specific trusted IP ranges; implement enhanced monitoring for unexpected process spawning from Flowise. Within 30 days: Monitor Flowise advisories for patch availability; develop an upgrade plan for versions 3.1.2 or later when stable releases are confirmed; audit and rotate all API keys and service accounts with Flowise access.

Flowise EUVD-2026-38434

Q: What is the CVSS score of EUVD-2026-38434?

EUVD-2026-38434 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.7%.

| CVE-2026-56274 HIGH

OS Command Injection (CWE-78)

2026-06-23 VulnCheck

GHSA-8rhx-2hcv-q49g

Command Injection Docker Flowise

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable Flowise UI/API, low complexity, requires any-role account or chatflow-permissioned API key (PR:L), no user interaction, full host RCE gives C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 23, 2026 - 14:17 EUVD

Source Code Evidence Fetched

Jun 23, 2026 - 13:05 vuln.today

Analysis Generated

Jun 23, 2026 - 13:05 vuln.today

CVE Published

Jun 23, 2026 - 12:13 cve.org

HIGH 8.7

DescriptionCVE.org

Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API access with view/update permissions for chatflows, can configure a malicious MCP server to bypass the validateCommandFlags blocklist (for example, 'docker build' is not blocked, and 'npx --yes' is not blocked while only '-y' is) and the validateArgsForLocalFileAccess checks, resulting in execution of arbitrary commands on the Flowise host.

AnalysisAI

Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update permissions) to abuse the Custom MCP Server feature and run arbitrary OS commands on the host. The validateCommandFlags blocklist and validateArgsForLocalFileAccess regex are incomplete - for example 'docker build' is permitted and 'npx --yes' is permitted while only '-y' is blocked - letting attackers point Flowise at a hostile Dockerfile or local script to achieve full host compromise. Publicly available exploit code exists (the GHSA advisory ships a reproduction), though there is no public exploit identified at time of analysis in CISA KEV.

Technical ContextAI

Flowise is an open-source low-code LLM orchestration platform (npm packages flowise and flowise-components) that lets users wire chatflows to external tools via the Model Context Protocol (MCP). When a chatflow includes a Custom MCP Server node, Flowise spawns a child process using a user-supplied command and arguments, guarded by two allow/deny functions in packages/components/nodes/tools/MCP/core.ts: validateCommandFlags (a hard-coded blocklist of dangerous flags per command) and validateArgsForLocalFileAccess (a regex check intended to prevent local file references). Both controls are incomplete: the docker blocklist only covers run/exec/-v/--volume/--privileged/--cap-add/--security-opt/--network/--pid/--ipc but omits build/pull/push/cp/commit, and the npx blocklist contains '-y' but not the equivalent '--yes' long form. The root cause is classic CWE-78 (OS Command Injection) via denylist-style validation of an interpreter invocation, where the denylist fails to be canonical or exhaustive over the set of dangerous flag aliases and subcommands.

RemediationAI

Vendor-released patch: upgrade flowise and flowise-components to 3.1.2 or later, which extends the validateCommandFlags blocklist and tightens the validateArgsForLocalFileAccess regex (see the GHSA-m99r-2hxc-cp3q advisory). If immediate upgrade is not possible, disable or remove the Custom MCP Server node type from chatflows and revoke API keys carrying chatflow update permissions from any non-administrative principals; on hosts where docker is installed, remove docker from the Flowise service account's PATH or run Flowise under a user that has no docker group membership, accepting that legitimate Docker-based MCP servers will stop working. Additionally restrict the Flowise web UI and API to trusted networks and disable open user self-registration via FLOWISE_USERNAME/PASSWORD-only access, since the prerequisite of 'any role' account dramatically lowers the bar otherwise.