CVE-2026-69263: Flowise env-var bypass reinstates

Q: Is CVE-2026-69263 actively exploited?

No confirmed active exploitation of CVE-2026-69263 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-69263?

1) Upgrade flowise and flowise-components to >= 3.1.3, which closes the npm_config_yes gap (see commit a4c4e4988cded15edf725e762560575b889ae351 and GHSA-xc48-889x-5qmw). 2) If patching is delayed, restrict who can create/edit Custom MCP server configurations to trusted admins only — treat this as an admin-only, not user-self-service, feature. 3) Audit any code paths that let user input set arbitrary environment variables reaching the npx invocation (env passthrough in node configs, workflow variables, webhook payloads). 4) Detection: monitor for npx process spawns from the Flowise host installing unexpected/unrecognized npm packages, and alert on any environment variable named npm_config_* being set outside of controlled deploy configs. 5) Consider running Flowise's MCP execution in a sandboxed/ephemeral container with no persistent secrets to limit blast radius even if bypassed again in the future.

CISO Take

Flowise's Custom MCP server feature shells out to npx to launch MCP tool packages, and a prior fix (CVE-2025-8943) tried to block that path by denying the -y/--yes flags plus a short list of environment variables — but npm also honors npm_config_yes=true as a silent equivalent to --yes, which the denylist missed, so npx still auto-installs and runs an attacker-named package with no confirmation. This is a classic incomplete-denylist bypass (CWE-184): the control looked complete but only covered the exact strings the developers thought of, not the underlying npm configuration surface. There's no public PoC or Nuclei template yet and EPSS sits low at 0.27% (though that still ranks in the top 81% of scored CVEs), and it isn't in CISA KEV, so exploitation isn't observed in the wild — but the impact is full code execution on the Flowise host via a feature (Custom MCP servers) that's core to how Flowise agents get tool capabilities. Any org running Flowise <= 3.1.2 with Custom MCP servers enabled should upgrade to 3.1.3 immediately; if you can't patch now, disable or tightly restrict who can configure Custom MCP servers and audit environment variable injection paths (webhooks, node inputs, admin settings) for npm_config_* values reaching the npx call in packages/components/nodes/tools/MCP/core.ts.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

Low observed exploitation likelihood today (no KEV listing, no public exploit code, no scanner template, EPSS 0.27%/top 81st percentile) but high potential impact: successful exploitation yields arbitrary code execution in the context of the Flowise process. The real risk driver is that this is a bypass of a security control that was already patched once, meaning attackers who studied the original fix (public GHSA + commit) can trivially derive this variant — the barrier to weaponization is low once someone reads the diff. CISA SSVC rates it ATTEND, consistent with a real-but-not-yet-urgent posture. Risk scales with how exposed the Custom MCP server configuration is (self-service low-priv users, unauthenticated API, or multi-tenant Flowise instances raise it significantly).

How does the attack unfold?

Malicious Configuration

Attacker with access to Flowise's Custom MCP server settings sets the environment variable npm_config_yes=true instead of the blocked -y/--yes flags.

AML.T0081

Tool Invocation

Flowise launches the Custom MCP server, invoking npx to fetch and run the configured MCP tool package.

AML.T0053

Bypass and Auto-Execution

npx reads npm_config_yes from the environment, silently reproduces --yes behavior, and auto-installs/executes the attacker-named package without confirmation.

AML.T0011.001

Host Compromise

The executed package runs arbitrary code under the Flowise process's privileges, enabling credential theft, lateral movement, or full server compromise.

AML.T0112

Malicious Configuration

Attacker with access to Flowise's Custom MCP server settings sets the environment variable npm_config_yes=true instead of the blocked -y/--yes flags.

AML.T0081

Tool Invocation

Flowise launches the Custom MCP server, invoking npx to fetch and run the configured MCP tool package.

AML.T0053

Bypass and Auto-Execution

npx reads npm_config_yes from the environment, silently reproduces --yes behavior, and auto-installs/executes the attacker-named package without confirmation.

AML.T0011.001

Host Compromise

The executed package runs arbitrary code under the Flowise process's privileges, enabling credential theft, lateral movement, or full server compromise.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	<= 3.1.2	`3.1.3`
Flowise	npm	<= 3.1.2	`3.1.3`

How severe is it?

CVSS 3.1

N/A

EPSS

0.5%

chance of exploitation in 30 days

Higher than 40% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Upgrade flowise and flowise-components to >= 3.1.3, which closes the npm_config_yes gap (see commit a4c4e4988cded15edf725e762560575b889ae351 and GHSA-xc48-889x-5qmw). 2) If patching is delayed, restrict who can create/edit Custom MCP server configurations to trusted admins only — treat this as an admin-only, not user-self-service, feature. 3) Audit any code paths that let user input set arbitrary environment variables reaching the npx invocation (env passthrough in node configs, workflow variables, webhook payloads). 4) Detection: monitor for npx process spawns from the Flowise host installing unexpected/unrecognized npm packages, and alert on any environment variable named npm_config_* being set outside of controlled deploy configs. 5) Consider running Flowise's MCP execution in a sandboxed/ephemeral container with no persistent secrets to limit blast radius even if bypassed again in the future.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0011.001 - Malicious Package AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.3 - AI System Security Controls

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-69263?

Flowise's Custom MCP server feature shells out to npx to launch MCP tool packages, and a prior fix (CVE-2025-8943) tried to block that path by denying the -y/--yes flags plus a short list of environment variables — but npm also honors npm_config_yes=true as a silent equivalent to --yes, which the denylist missed, so npx still auto-installs and runs an attacker-named package with no confirmation. This is a classic incomplete-denylist bypass (CWE-184): the control looked complete but only covered the exact strings the developers thought of, not the underlying npm configuration surface. There's no public PoC or Nuclei template yet and EPSS sits low at 0.27% (though that still ranks in the top 81% of scored CVEs), and it isn't in CISA KEV, so exploitation isn't observed in the wild — but the impact is full code execution on the Flowise host via a feature (Custom MCP servers) that's core to how Flowise agents get tool capabilities. Any org running Flowise <= 3.1.2 with Custom MCP servers enabled should upgrade to 3.1.3 immediately; if you can't patch now, disable or tightly restrict who can configure Custom MCP servers and audit environment variable injection paths (webhooks, node inputs, admin settings) for npm_config_* values reaching the npx call in packages/components/nodes/tools/MCP/core.ts.

Is CVE-2026-69263 actively exploited?

No confirmed active exploitation of CVE-2026-69263 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-69263?

1) Upgrade flowise and flowise-components to >= 3.1.3, which closes the npm_config_yes gap (see commit a4c4e4988cded15edf725e762560575b889ae351 and GHSA-xc48-889x-5qmw). 2) If patching is delayed, restrict who can create/edit Custom MCP server configurations to trusted admins only — treat this as an admin-only, not user-self-service, feature. 3) Audit any code paths that let user input set arbitrary environment variables reaching the npx invocation (env passthrough in node configs, workflow variables, webhook payloads). 4) Detection: monitor for npx process spawns from the Flowise host installing unexpected/unrecognized npm packages, and alert on any environment variable named npm_config_* being set outside of controlled deploy configs. 5) Consider running Flowise's MCP execution in a sandboxed/ephemeral container with no persistent secrets to limit blast radius even if bypassed again in the future.

What systems are affected by CVE-2026-69263?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP tool integrations, agent orchestration platforms.

What is the CVSS score for CVE-2026-69263?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP tool integrationsagent orchestration platforms

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0011.001 Malicious Package

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.

Exploitation Scenario

An attacker with access to configure (or inject values into) a Flowise Custom MCP server — e.g., a malicious insider, a compromised low-privilege account, or an attacker who found an unauthenticated/IDOR path to the MCP config API — sets the environment variable npm_config_yes=true on the Custom MCP server definition instead of using the blocked -y/--yes CLI flags. When that Custom MCP server is launched (by the platform or by an agent invoking the tool), Flowise shells out to npx to fetch and run the configured MCP package; npx reads npm_config_yes from the environment, silently treats it as --yes, and auto-installs and executes an attacker-controlled or typosquatted npm package name with no interactive confirmation — achieving code execution on the Flowise server under the service's privileges.

Weaknesses (CWE)

CWE-184 Incomplete List of Disallowed Inputs Primary CWE-184 Incomplete List of Disallowed Inputs Primary CWE-184 Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.