External risk intelligence

Flowise Remote Code Execution via Custom MCP Node

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-73601

Flowise is a web-based low-code platform commonly deployed as a network-accessible service to build and manage AI workflows. As a web application, it is typically reachable via browser interfaces and APIs, making its attack surface common for internet-facing or externally accessible deployments in corporate or developer environments.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in Flowise, a low-code platform for building AI workflows. The issue allows authenticated users to potentially execute arbitrary commands on the underlying system by manipulating specific configurations. The main concern is confirming relevance and exposure.

Allows command execution through configuration.
Matters due to system control risk.
Confirm if Flowise is in use.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access can exploit this vulnerability by manipulating environment variables and command arguments within the Custom MCP node. By carefully crafting these inputs, an attacker can bypass security checks and execute arbitrary commands on the underlying system. This could lead to a compromise of the server where Flowise is running.

Authenticated access is required.
Manipulate environment variables and command arguments.
Arbitrary command execution and system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated user to execute arbitrary commands on the system hosting Flowise. This is possible when the Custom MCP node is configured with stdio and the attacker can manipulate specific environment variables or command arguments, potentially leading to unauthorized system access and control.

System commands and configurations.
Authenticated users manipulating variables.
Unauthorized system access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Flowise deployments, particularly those using the Custom MCP node with the `stdio` protocol. Owners of application platforms or internal development environments where Flowise is deployed should lead the initial triage. The first practical step is to identify all Flowise instances, determine their exposure (especially if network-reachable), confirm reachability and business criticality, and then assign an accountable owner for remediation planning.

Application platform owners should address this.
Verify custom MCP node and protocol configuration.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Flowise?

Flowise is a low-code software platform that enables users to design and manage complex AI-driven workflows through a visual interface. It acts as an integration layer, allowing developers to connect various LLMs and data sources without writing extensive code. Because it handles sensitive automation tasks, it is often hosted as a centralized service within developer or corporate environments to coordinate AI logic.

What does CWE-95 mean in the context of CVE-2026-73601?

CWE-95 refers to Improper Neutralization of Directives in Dynamically Evaluated Code, commonly known as Code Injection. In this vulnerability, the software fails to properly sanitize user-provided input before using it to construct commands. Because the system treats this malicious input as legitimate instructions, it inadvertently grants an attacker the ability to execute unauthorized system-level commands on the host server.

How does an attacker trigger this vulnerability?

An attacker must have authenticated access to the Flowise instance to trigger the flaw. The vulnerability specifically requires the Custom MCP node to be configured with the 'stdio' protocol. If the node is not configured to use 'stdio', the specific command-manipulation path described in this CVE is not applicable, as the code execution relies on how that protocol processes environment variables.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal identifies Flowise as a web-based service frequently deployed in network-accessible configurations, such as internal or internet-facing developer environments. Because it is reachable via browser interfaces and APIs, any instance exposed to a network—particularly one accessible from the internet—presents a broader attack surface for authenticated users to reach and exploit this vulnerability.

What should I do if I run Flowise?

Begin by auditing your current deployments to locate all active Flowise instances and verify if the Custom MCP node is enabled with the 'stdio' protocol. Prioritize instances that are network-reachable or host critical business workflows. Once identified, assign an owner to oversee the implementation of available software updates to secure the platform against command execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.