Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless FLOWISE_USERNAME and FLOWISE_PASSWORD are set, an attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, resulting in complete compromise of the platform container or server.
The Custom MCP function in Flowise is designed to execute system commands (e.g., launching local MCP servers). The default Flowise installation runs without authentication unless the FLOWISE_USERNAME and FLOWISE_PASSWORD variables are manually set. An attacker can send a crafted JSON payload with the 'x-request-from: internal' header to the /api/v1/node-load-method/customMCP endpoint, allowing execution of arbitrary operating system commands without authorization. The vulnerability results from the lack of sandboxing for executed commands and a minimal access control model devoid of an RBAC mechanism.
Successful exploitation of the vulnerability leads to complete takeover of the container or server running Flowise — the attacker gains the ability to execute arbitrary OS commands with the privileges of the application process.
Update Flowise to version 3.0.6 or later. Until the update is applied, it is recommended to enforce authentication by setting the FLOWISE_USERNAME and FLOWISE_PASSWORD environment variables and restrict network access to API endpoints exclusively to trusted hosts.
Flowise in versions 2.2.7-patch.1 and earlier (all versions before 3.0.6)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XFlowiseai Flowise
APPFlowiseai< 3.0.6
Related vulnerabilities
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that ...
Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter t...
Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenti...
Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@fl...
Flowise: pominięcie uwierzytelnienia przez hardkodowany sekret sesji