Executive brief
Flowise, an open-source tool for building LLM applications, contains a critical security flaw in its Custom MCP feature. This feature is intended to run system commands to manage local servers, but it lacks proper security boundaries and access controls. An attacker can exploit this to run unauthorized commands on the underlying server or container, potentially leading to a full system takeover and theft of sensitive data.
Technical details
A remote code execution (RCE) vulnerability exists in Flowise versions prior to 3.0.6 within the Custom Model Context Protocol (MCP) feature. The root cause is a lack of sandboxing and insufficient access controls on the `/api/v1/node-load-method/customMCP` endpoint. Because Flowise often runs without authentication by default and lacks role-based access control (RBAC), an attacker can send a crafted JSON payload containing OS commands with the header 'x-request-from: internal' to achieve arbitrary command execution. This allows for complete compromise of the host server or container. The issue is addressed in version 3.0.6.
Affected products
- FlowiseAI Flowise < 3.0.6 (including 2.2.7-patch.1 and earlier)
Timeline
- 2025-09-13: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: NVD publication and CVE assignment