Securaity Browse advisories
SA-26-257 Critical

Flowise: Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed…

Flowise

More for Flowise RSS feed for Flowise

Severity
Critical, CVSS 9.8
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Record
CVE-2025-71336
Affects
Flowise
Known exploited
Not listed in the CISA Known Exploited Vulnerabilities catalog
Published
Record first published by the source
June 25, 2026
Source last modified
October 12, 2026

Description

Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless FLOWISE_USERNAME and FLOWISE_PASSWORD are set, an attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, resulting in complete compromise of the platform container or server.

Description quoted from the NVD record.

Who is affected

Flowise is a tool for building apps that use AI language models. This flaw affects Flowise versions before 3.0.6 (versions 2.2.7-patch.1 and earlier are listed as affected). The problem is in the Custom MCP feature, a part that is designed to run commands on the computer where Flowise is installed. An attacker can send a specially made web request to it and run any command they like, taking complete control of the server running Flowise. Flowise has only basic login controls, and a default installation needs no login unless a username and password are set. This flaw is rated Critical.

What to do

  1. First, find out whether anyone in your organization uses Flowise, including test or trial setups, so that no copy is missed.
  2. If someone in your organization installed or runs Flowise, that person should update it to version 3.0.6 or later as soon as possible.
  3. If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update will be done.
  4. After updating, check that each Flowise installation shows version 3.0.6 or later.

Analysis written from the source record as of October 12, 2026 and reviewed before publishing.

Sources

MORE ADVISORIES

See all