Flowise versions prior to 3.0.6 contain an unsandboxed remote code execution flaw in the Custom MCP feature, which is used to launch OS commands such as launching local MCP servers. The flaw is triggered by a crafted JSON payload sent to the /api/v1/node-load-method/customMCP endpoint with the header “x-request-from: internal”. Because Flowise implements a minimal authentication and authorization model that, by default, runs without credentials, an attacker can execute arbitrary OS commands from the same network context, leading to full compromise of the Flowise container or host.

The vulnerability affects all Flowise:Flowise deployments running version 2.2.7-patch.1 and earlier, including the default installations that do not set FLOWISE_USERNAME and FLOWISE_PASSWORD. Any instance where the Custom MCP endpoint is exposed over a network accessible to an attacker is susceptible.

The CVSS score of 9.3 indicates a critical risk level. The lack of a publicly available EPSS score suggests no large-scale observed exploitation yet, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be remote: an attacker who can reach the Custom MCP API can trigger the vulnerability. Successful exploitation would grant the attacker the operating‑system privileges of the Flowise process, effectively resulting in a complete platform compromise.