Active Exploitation of Flowise CustomMCP RCE Exposes Thousands of Internet-Facing Instances
Active Exploitation · 10 sources · Updated 4mo ago · First seen Apr 7, 2026
Threat actors are actively exploiting CVE-2025-59528, a CVSS 10.0 remote code execution flaw in the open-source AI platform Flowise. The bug affects Flowise versions through 3.0.5 and stems from the CustomMCP node unsafely passing user-controlled input into JavaScript execution, allowing attackers with an API token to run arbitrary code with full Node.js runtime privileges. Researchers said the issue can be triggered remotely via a crafted HTTP POST request without user interaction, leading to operating system command execution, filesystem access, sensitive data theft, and full system compromise.
Security researchers observed in-the-wild exploitation originating from a single Starlink IP address, while warning that roughly 12,000 to 15,000 internet-exposed Flowise instances sharply expand the attack surface for opportunistic attacks. Flowise disclosed the vulnerability in 2025, credited researcher Kim SooHyun, and patched the flaw in version 3.0.6. The incident marks the third Flowise vulnerability reported as exploited in the wild after CVE-2025-8943 and CVE-2025-26319, increasing pressure on organizations to upgrade immediately and limit public exposure of Flowise APIs.
