CVE-2026-40933: Flowise Authenticated RCE via MCP Adapters
Summary
CVE-2026-40933: Flowise: Authenticated RCE Via MCP Adapters. Affects flowise versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flowise is an open-source platform designed for building and deploying machine learning models. It provides a user-friendly interface for creating workflows and integrating various components. However, it has a critical vulnerability that allows authenticated users to execute arbitrary commands on the server, potentially compromising the entire system.
Vulnerability Detail
The vulnerability arises from unsafe serialization of stdio commands in the MCP adapter. An authenticated attacker can exploit this flaw by adding an MCP stdio server with arbitrary commands, leading to remote code execution. Despite existing input sanitization checks, the system fails to adequately validate user inputs, allowing attackers to combine safe commands with harmful arguments, such as 'npx -c touch /tmp/pwn', which can execute commands on the underlying operating system.
How To Fix
Latest published version: 3.1.4 as of 22 Oct 2026
npm install flowise@3.1.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.0
This is the first release that contains the fix.
npm install flowise@3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the MCP configuration interface to trusted users only, and monitor the commands being executed to prevent unauthorized access.
Conclusion
CVE-2026-40933 presents a significant risk to users of Flowise due to its potential for remote code execution through improper input handling. It is crucial to update to the patched versions of the affected packages and implement security best practices to safeguard against exploitation.
See every vulnerability recorded for flowise →
FAQ
CVE-2026-40933 is a critical vulnerability in Flowise that allows authenticated users to execute arbitrary commands on the server due to unsafe input handling in the MCP adapter.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized command execution, allowing attackers to compromise the server, access sensitive data, or disrupt services.
The CVSS score of this vulnerability is 9.9, indicating a critical level of risk.
If immediate updates are not possible, implement strict access controls and monitor command executions as a temporary measure to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for flowise.
