Loading vulnerability…
Flowise Custom MCP stdio Command Injection
CVE-2026-40933 is a post-authentication command-injection vulnerability in Flowise Custom MCP support using the stdio transport. Flowise serializes user-configured MCP server commands and arguments into local process execution. Validation and command allowlisting can be bypassed because permitted launchers such as npm or npx can accept options or environment-controlled behavior that executes attacker-controlled code. A malicious Custom MCP configuration can be supplied directly by a user permitted to create or edit chatflows, or embedded in a crafted chatflow such that importing and rendering it triggers MCP tool enumeration and process execution. The flaw affects self-hosted Flowise deployments where stdio MCP is enabled; Flowise Cloud is not affected because stdio MCP is disabled.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated attacker can execute arbitrary operating-system commands with the privileges of the Flowise process. In containerized deployments this process may run as root. Successful exploitation can compromise Flowise-managed credentials, API keys, connected SaaS services, databases, cloud environments, and other systems reachable from the Flowise host.
If you can’t patch tonight, do this now.
Restrict Custom MCP creation, editing, and chatflow import to fully trusted administrators. Do not rely solely on CUSTOM_MCP_SECURITY_CHECK or command/argument denylists. Treat MCP configurations and imported chatflows as untrusted executable-process configuration. Run Flowise and MCP processes under dedicated least-privilege identities, isolate them from sensitive networks and secrets, and prevent access to unnecessary internal services.
Patch, then assume compromise.
Flowise identified version 3.1.0 as fixing the original CVE-2026-40933 command-flag validation issue. However, reported bypasses against later 3.1.x releases show that upgrading alone may not eliminate the underlying risk where untrusted users or imported chatflows can control stdio MCP configuration. Disable stdio MCP and use SSE by setting CUSTOM_MCP_PROTOCOL=sse unless local process-backed MCP servers are strictly required. Apply the latest vendor-supported release and review vendor advisories for any subsequent fixes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.