Critical Flowise MCP Bypass Allows Remote Code Execution

Flowise disclosed a critical remote code execution flaw, tracked as CVE-2026-56274, affecting versions before 3.1.2 in the Custom MCP Server feature. The vulnerability stems from multiple OS command injection paths in validateCommandFlags and validateArgsForLocalFileAccess, allowing attackers to configure a malicious MCP server and execute arbitrary commands on the Flowise host. The issue is rated CVSS 9.9 and is remotely exploitable.

Advisories describe three bypass techniques: an incomplete Docker argument blocklist that permits docker build with a remote URL, an npx blocklist bypass where --yes is allowed even though -y is blocked, and a Unix path validation weakness that lets paths beginning with // evade local file access checks for node. Exploitation requires any Flowise account role or API access with view and update permissions for chatflows. Organizations were urged to upgrade to Flowise 3.1.2 or later, review MCP server configurations, and restrict chatflow management permissions.