Flowise Custom MCP Flaw Enables One-Click Remote Code Execution

Researchers disclosed CVE-2026-40933, a critical remote code execution flaw in self-hosted Flowise deployments tied to the platform’s Custom MCP support over stdio. The issue lets an authenticated attacker execute arbitrary OS commands with the privileges of the Flowise process by supplying a malicious MCP server configuration, either directly or by embedding it in a shared chatflow. In the demonstrated one-click scenario, importing the crafted chatflow alone can trigger server-side command execution when Flowise enumerates available MCP actions, before any save or run step. Flowise Cloud is not affected because stdio MCP is disabled, but open-source and enterprise self-hosted deployments are vulnerable by default.

Reporting on the flaw said Flowise’s initial mitigation—blocking risky flags for allowlisted commands—does not fix the underlying problem because the feature still launches user-controlled processes, and researchers showed it can be bypassed through environment variables. Recommended defenses include upgrading to Flowise 3.1.0, limiting who can add or import MCP configurations, isolating Flowise from sensitive internal systems, and disabling stdio MCP unless it is strictly required by setting:

CUSTOM_MCP_PROTOCOL=sse

The disclosures also warn that the bug reflects a broader architectural and supply-chain risk for agentic AI platforms that expose unsandboxed stdio-based MCP configuration to lower-trust users or untrusted artifacts.