CVE-2026-56274

Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess

Published Jun 23, 2026 CVSS 4.0 · 8.7 High EPSS 7.5% KEV · Not listed

Description

Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API access with view/update permissions for chatflows, can configure a malicious MCP server to bypass the validateCommandFlags blocklist (for example, 'docker build' is not blocked, and 'npx --yes' is not blocked while only '-y' is) and the validateArgsForLocalFileAccess checks, resulting in execution of arbitrary commands on the Flowise host.

Analysis

Technical impact

Flowise versions prior to 3.1.2 contain operating‑system command injection vulnerabilities in the Custom MCP Server feature. By submitting a malicious MCP server configuration, an attacker can bypass the validateCommandFlags blocklist and the validateArgsForLocalFileAccess checks, allowing execution of arbitrary commands on the host system. This flaw endangers confidentiality, integrity, and availability of the Flowise host.

Affected Systems

All installations of Flowise main product running a version earlier than 3.1.2 are affected. The vulnerability is present regardless of the user role; any Flowise account or API access that can modify chatflows is sufficient to abuse the flaw.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. EPSS score of 8% indicates a measurable exploitation probability, and the vulnerability is not listed in CISA KEV. The likely attack vector is via a legitimate Flowise account or API key with chatflow update permissions. An attacker could remotely trigger the vulnerable MCP server configuration and execute arbitrary commands on the host, but requires authentication to the Flowise instance.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Flowise

unaffected

Version	Status	Constraints
`0`	affected	< 3.1.2
`3.1.2`	unaffected	—

Flowise

Flowise Components

unaffected

Version	Status	Constraints
`0`	affected	< 3.1.2
`3.1.2`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Flowiseai

Flowise

Version	Status	Scheme	Platform
`[0,3.1.2)`	affected	semver	—
`3.1.2`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Flowise to version 3.1.2 or later where the command injection issue is fixed.
Disable or remove the Custom MCP Server feature if it is not required.
Restrict user and API permissions by removing view or update permissions for chatflows from accounts that do not need them, enforcing least privilege.

Generated by OpenCVE AI on August 24, 2026 at 22:42 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 7.5% (7.521% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-m99r-2hxc-cp3q
https://www.vulncheck.com/advisories/flowise-remote-code-execution-via-mcp-security-bypass-in-validatecommandflags-and-validateargsforlocalfileaccess

History

Jun 23, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 23, 2026 12:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API access with view/update permissions for chatflows, can configure a malicious MCP server to bypass the validateCommandFlags blocklist (for example, 'docker build' is not blocked, and 'npx --yes' is not blocked while only '-y' is) and the validateArgsForLocalFileAccess checks, resulting in execution of arbitrary commands on the Flowise host.
Title		Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess
First Time appeared		Flowiseai Flowiseai flowise
Weaknesses		CWE-78
CPEs		cpe:2.3:a:flowiseai:flowise::::::::
Vendors & Products		Flowiseai Flowiseai flowise
References		https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-m99r-2hxc-cp3q https://www.vulncheck.com/advisories/flowise-remote-code-execution-via-mcp-security-bypass-in-validatecommandflags-and-validateargsforlocalfileaccess
Metrics		cvssV3_1 `{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`