CVE-2025-71336: Flowise unauthenticated RCE

CISO Take

Flowise's Custom MCP feature is designed to execute OS commands for launching local MCP servers, but the endpoint at /api/v1/node-load-method/customMCP trusts any request bearing the header 'x-request-from: internal', bypassing authentication entirely on default installations that ship without credentials configured. This is a network-exploitable, zero-privilege, zero-interaction critical (CVSS 9.8) OS command injection — the simplest class of RCE — meaning automated exploitation is trivial and weaponization will accelerate rapidly even without a documented public exploit today. Flowise carries 112 prior CVEs, signaling a persistent pattern of weak security posture that makes this discovery unsurprising but no less urgent. Patch immediately to 3.0.6+; if patching is delayed, enforce FLOWISE_USERNAME and FLOWISE_PASSWORD and block the /api/v1/node-load-method/ path at your perimeter until remediation is complete.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

Critical. The combination of unauthenticated network access (AV:N, PR:N, UI:N, AC:L) and complete C/I/A impact (CVSS 9.8) places this at the highest exploitability tier. Default Flowise deployments ship without authentication, meaning the majority of internet-exposed instances are immediately exploitable by anyone who knows the header bypass. The mechanism is trivial — a single spoofed HTTP header — requiring no specialized AI or security expertise. With 112 previous CVEs in the package, security hygiene has been consistently poor, suggesting this vulnerability is unlikely to be isolated. Any Flowise instance accessible from untrusted networks should be treated as potentially compromised until patched.

How does the attack unfold?

Reconnaissance

Attacker scans for internet-exposed Flowise instances on default port 3000 via Shodan or Censys, identifying targets by HTTP fingerprint or the Flowise UI login page.

AML.T0006

Authentication Bypass

Attacker sends a POST request to /api/v1/node-load-method/customMCP with the 'x-request-from: internal' header, bypassing Flowise's minimal auth check and exploiting the complete absence of RBAC.

AML.T0049

OS Command Injection

Crafted JSON payload triggers unsandboxed OS command execution (CWE-78) in the Custom MCP handler, spawning an attacker-controlled process with the Flowise service account's privileges on the host or container.

AML.T0050

Credential Harvest & Lateral Movement

Attacker establishes a reverse shell, exfiltrates all LLM API keys, agent flow configurations, and database credentials from the Flowise environment, then pivots to connected AI infrastructure and cloud metadata endpoints.

AML.T0083

Reconnaissance

Attacker scans for internet-exposed Flowise instances on default port 3000 via Shodan or Censys, identifying targets by HTTP fingerprint or the Flowise UI login page.

AML.T0006

Authentication Bypass

Attacker sends a POST request to /api/v1/node-load-method/customMCP with the 'x-request-from: internal' header, bypassing Flowise's minimal auth check and exploiting the complete absence of RBAC.

AML.T0049

OS Command Injection

Crafted JSON payload triggers unsandboxed OS command execution (CWE-78) in the Custom MCP handler, spawning an attacker-controlled process with the Flowise service account's privileges on the host or container.

AML.T0050

Credential Harvest & Lateral Movement

Attacker establishes a reverse shell, exfiltrates all LLM API keys, agent flow configurations, and database credentials from the Flowise environment, then pivots to connected AI infrastructure and cloud metadata endpoints.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

1.6%

chance of exploitation in 30 days

Higher than 73% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

7 steps

Patch to Flowise 3.0.6+ immediately — this is the only complete fix.
If patching is delayed: set FLOWISE_USERNAME and FLOWISE_PASSWORD environment variables to enable authentication.
Block network access to the Flowise API (default port 3000) from untrusted networks via firewall rules or a reverse proxy with IP allowlisting.
Configure WAF or reverse proxy to reject any inbound requests containing the 'x-request-from: internal' header before they reach Flowise.
Audit Flowise access logs for POST requests to /api/v1/node-load-method/customMCP from unexpected source IPs, especially prior to patch deployment.
Rotate all API keys and credentials stored in or accessible by Flowise following any suspected exposure.
Review container runtime and OS process logs for unusual child process execution (sh, bash, curl, nc) originating from the Flowise service account.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0072 - Reverse Shell AML.T0081 - Modify AI Agent Configuration AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.2.6 - AI system access control

NIST AI RMF

GOVERN 1.7 - Processes and policies are in place for AI risk management

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2025-71336?

Flowise's Custom MCP feature is designed to execute OS commands for launching local MCP servers, but the endpoint at /api/v1/node-load-method/customMCP trusts any request bearing the header 'x-request-from: internal', bypassing authentication entirely on default installations that ship without credentials configured. This is a network-exploitable, zero-privilege, zero-interaction critical (CVSS 9.8) OS command injection — the simplest class of RCE — meaning automated exploitation is trivial and weaponization will accelerate rapidly even without a documented public exploit today. Flowise carries 112 prior CVEs, signaling a persistent pattern of weak security posture that makes this discovery unsurprising but no less urgent. Patch immediately to 3.0.6+; if patching is delayed, enforce FLOWISE_USERNAME and FLOWISE_PASSWORD and block the /api/v1/node-load-method/ path at your perimeter until remediation is complete.

Is CVE-2025-71336 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71336, increasing the risk of exploitation.

How to fix CVE-2025-71336?

1. Patch to Flowise 3.0.6+ immediately — this is the only complete fix. 2. If patching is delayed: set FLOWISE_USERNAME and FLOWISE_PASSWORD environment variables to enable authentication. 3. Block network access to the Flowise API (default port 3000) from untrusted networks via firewall rules or a reverse proxy with IP allowlisting. 4. Configure WAF or reverse proxy to reject any inbound requests containing the 'x-request-from: internal' header before they reach Flowise. 5. Audit Flowise access logs for POST requests to /api/v1/node-load-method/customMCP from unexpected source IPs, especially prior to patch deployment. 6. Rotate all API keys and credentials stored in or accessible by Flowise following any suspected exposure. 7. Review container runtime and OS process logs for unusual child process execution (sh, bash, curl, nc) originating from the Flowise service account.

What systems are affected by CVE-2025-71336?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, LLM workflow orchestration platforms, MCP server deployments, Multi-agent pipelines, RAG pipelines with Flowise-managed retrievers.

What is the CVSS score for CVE-2025-71336?

CVE-2025-71336 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 1.56%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksLLM workflow orchestration platformsMCP server deploymentsMulti-agent pipelinesRAG pipelines with Flowise-managed retrievers

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0072 Reverse Shell

AML.T0081 Modify AI Agent Configuration

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 1.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless FLOWISE_USERNAME and FLOWISE_PASSWORD are set, an attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, resulting in complete compromise of the platform container or server.

Exploitation Scenario

An attacker discovers an internet-exposed Flowise instance (default port 3000, identifiable via HTTP response headers or the Flowise UI login page fingerprint) using a Shodan or Censys query. They craft a POST request to /api/v1/node-load-method/customMCP with the header 'x-request-from: internal' and a JSON body containing a reverse shell command — for example, a curl-piped bash payload to attacker-controlled infrastructure. Flowise, treating the request as an internal call and lacking any RBAC, executes the OS command directly. The attacker receives a reverse shell as the Flowise process user, then reads environment variables to harvest all stored LLM API keys, database connection strings, and OAuth tokens. From inside the container they enumerate the internal network, dump the entire Flowise flow database, and implant a backdoored custom node that persists across service restarts, providing ongoing access even after the vulnerability is patched without credential rotation.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.