CVE-2026-58057: Flowise NODE_OPTIONS denylist

CISO Take

Flowise's Custom MCP node validates stdio environment variables against a denylist using case-sensitive string matching, so on Windows deployments an authenticated user can submit the variable as 'node_options' instead of 'NODE_OPTIONS' and slip past the filter entirely, since Windows treats environment variable names as case-insensitive. Once bypassed, the attacker injects a NODE_OPTIONS=--require flag that loads an arbitrary module when Flowise spawns the MCP stdio process, yielding code execution in the Flowise server context. This is a low-complexity logic flaw in a security control rather than a novel exploitation technique, and CVSS 5.0 (AC:H, PR:L) reflects that it requires an authenticated account able to configure Custom MCP nodes plus a Windows-hosted deployment — a public PoC already exists and a VulnCheck advisory has been published, but EPSS remains negligible (0.0024) and there is no CISA KEV listing or scanner template, so mass exploitation is unlikely though targeted abuse by insiders or compromised low-privileged accounts is realistic. Patch to Flowise 3.1.3 or later immediately; if you cannot patch, avoid hosting Flowise on Windows, restrict who can create/edit Custom MCP nodes to trusted admins, and monitor for Node.js child processes launched with unexpected --require flags or NODE_OPTIONS values originating from Flowise's MCP tooling.

Sources: NVD EPSS GitHub VulnCheck ATLAS

What is the risk?

Medium risk overall: the flaw enables full remote code execution in the Flowise server process, but the attack requires an authenticated, low-privileged account with permission to configure Custom MCP nodes (PR:L) and a Windows host, which narrows the exposure compared to unauthenticated network-wide flaws. High attack complexity (AC:H) reflects the platform-specific case-insensitivity quirk and the need to craft a working --require payload. A public PoC and vendor advisory exist, increasing the chance of opportunistic abuse against multi-tenant or loosely-governed Flowise deployments where non-admin users can define MCP integrations, but EPSS scoring (0.0024) and absence from CISA KEV indicate no evidence of active exploitation in the wild yet.

How does the attack unfold?

Node Configuration

An authenticated low-privileged user configures a Custom MCP node and sets an stdio environment variable named 'node_options' to bypass the case-sensitive NODE_OPTIONS denylist check.

AML.T0081

Environment Variable Injection

On Windows, the OS resolves 'node_options' as equivalent to 'NODE_OPTIONS', allowing the attacker-controlled '--require' flag to be passed through undetected.

Code Execution

When Flowise spawns the MCP stdio subprocess, Node.js honors NODE_OPTIONS and loads the attacker's malicious module via --require, executing arbitrary code.

AML.T0050

Impact

The attacker gains code execution in the Flowise server context, enabling credential theft, lateral movement, or tampering with other agent workflows and integrations.

AML.T0112

Node Configuration

An authenticated low-privileged user configures a Custom MCP node and sets an stdio environment variable named 'node_options' to bypass the case-sensitive NODE_OPTIONS denylist check.

AML.T0081

Environment Variable Injection

On Windows, the OS resolves 'node_options' as equivalent to 'NODE_OPTIONS', allowing the attacker-controlled '--require' flag to be passed through undetected.

Code Execution

When Flowise spawns the MCP stdio subprocess, Node.js honors NODE_OPTIONS and loads the attacker's malicious module via --require, executing arbitrary code.

AML.T0050

Impact

The attacker gains code execution in the Flowise server context, enabling credential theft, lateral movement, or tampering with other agent workflows and integrations.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

5.0 / 10

EPSS

1.3%

chance of exploitation in 30 days

Higher than 68% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Exploit published in Exploit-DB

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

1 step

Upgrade to Flowise 3.1.3 or later, which fixes the case-sensitive denylist comparison for Custom MCP stdio environment variables. If immediate patching isn't possible: restrict the ability to create or edit Custom MCP nodes to trusted administrators only (least privilege), avoid running Flowise on Windows hosts where feasible, and place Flowise behind network controls limiting who can reach the workflow builder UI. For detection, monitor Flowise server process creation for Node.js child processes launched with NODE_OPTIONS or --require flags, alert on any environment variable names in MCP node configs that are case-variants of denylisted entries (NODE_OPTIONS, NODE_DEBUG, etc.), and audit recent Custom MCP node configuration changes for suspicious environment variable entries.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM07:2025 - Insecure Plugin/Tool Design

Frequently Asked Questions

What is CVE-2026-58057?

Flowise's Custom MCP node validates stdio environment variables against a denylist using case-sensitive string matching, so on Windows deployments an authenticated user can submit the variable as 'node_options' instead of 'NODE_OPTIONS' and slip past the filter entirely, since Windows treats environment variable names as case-insensitive. Once bypassed, the attacker injects a NODE_OPTIONS=--require flag that loads an arbitrary module when Flowise spawns the MCP stdio process, yielding code execution in the Flowise server context. This is a low-complexity logic flaw in a security control rather than a novel exploitation technique, and CVSS 5.0 (AC:H, PR:L) reflects that it requires an authenticated account able to configure Custom MCP nodes plus a Windows-hosted deployment — a public PoC already exists and a VulnCheck advisory has been published, but EPSS remains negligible (0.0024) and there is no CISA KEV listing or scanner template, so mass exploitation is unlikely though targeted abuse by insiders or compromised low-privileged accounts is realistic. Patch to Flowise 3.1.3 or later immediately; if you cannot patch, avoid hosting Flowise on Windows, restrict who can create/edit Custom MCP nodes to trusted admins, and monitor for Node.js child processes launched with unexpected --require flags or NODE_OPTIONS values originating from Flowise's MCP tooling.

Is CVE-2026-58057 actively exploited?

A working exploit for CVE-2026-58057 is published in Exploit-DB, increasing the risk of exploitation.

How to fix CVE-2026-58057?

Upgrade to Flowise 3.1.3 or later, which fixes the case-sensitive denylist comparison for Custom MCP stdio environment variables. If immediate patching isn't possible: restrict the ability to create or edit Custom MCP nodes to trusted administrators only (least privilege), avoid running Flowise on Windows hosts where feasible, and place Flowise behind network controls limiting who can reach the workflow builder UI. For detection, monitor Flowise server process creation for Node.js child processes launched with NODE_OPTIONS or --require flags, alert on any environment variable names in MCP node configs that are case-variants of denylisted entries (NODE_OPTIONS, NODE_DEBUG, etc.), and audit recent Custom MCP node configuration changes for suspicious environment variable entries.

What systems are affected by CVE-2026-58057?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP tool integrations, low-code AI workflow platforms.

What is the CVSS score for CVE-2026-58057?

CVE-2026-58057 has a CVSS v3.1 base score of 5.0 (MEDIUM). The EPSS exploitation probability is 1.27%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP tool integrationslow-code AI workflow platforms

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07:2025

What are the technical details?

Original Advisory

Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, where environment names are case-insensitive, supplying 'node_options' bypasses the NODE_OPTIONS denylist entry. An authenticated user who can configure a Custom MCP node can thereby inject NODE_OPTIONS --require and execute arbitrary code in the Flowise server context.

Exploitation Scenario

An attacker who has obtained or been granted a low-privileged Flowise account (e.g., a collaborator on a shared instance) creates or edits a Custom MCP node and adds an stdio environment variable named 'node_options' (lowercase) set to '--require /path/to/malicious.js'. Flowise's denylist check only blocks the exact string 'NODE_OPTIONS', so the entry passes validation. When the Windows-hosted Flowise server spawns the MCP stdio subprocess, Windows resolves 'node_options' as equivalent to 'NODE_OPTIONS' at the OS level, causing Node.js to load the attacker's module via --require and execute arbitrary code with the privileges of the Flowise server process — giving the attacker a foothold to exfiltrate API keys, pivot to connected systems, or tamper with other agent workflows.

Weaknesses (CWE)

CWE-178 Improper Handling of Case Sensitivity Primary CWE-178 Improper Handling of Case Sensitivity

CWE-178 — Improper Handling of Case Sensitivity: The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

[Architecture and Design] Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis

Source: MITRE CWE corpus.