CVE-2026-73601: Flowise RCE — CRITICAL

CISO Take

Flowise's Custom MCP node lets any authenticated user configure a stdio-based Model Context Protocol integration, and versions before 3.1.3 fail to properly validate the environment variables and working directory passed to that process — a logged-in user can smuggle shell commands through PYTHONWARNINGS/BROWSER (Python) or the working directory (Node) and achieve arbitrary code execution on the host running Flowise. This matters because Flowise sits at the center of many low-code AI agent deployments and requires only an ordinary authenticated account, not an admin, to trigger — turning a routine workspace login into full server compromise. Exploitation signals are currently modest: EPSS sits at 0.6% (top 54th percentile), there's no public exploit or Nuclei template, it isn't in CISA KEV, and CISA's SSVC verdict is TRACK rather than immediate action — but Flowise's history of 156 other CVEs should temper confidence in its default hardening. Patch to Flowise 3.1.3 or later now; until then, restrict who can create or edit Custom MCP nodes, disable stdio-protocol MCP integrations that aren't in active use, and run Flowise in an isolated, least-privilege container so a code-execution bug there can't reach the rest of your infrastructure.

Sources:NVDEPSSGitHub AdvisoryVulnCheckCISA SSVCATLAS

What is the risk?

Rated critical by the vendor because successful exploitation yields arbitrary OS command execution, but real-world exploitation pressure is currently low: EPSS is 0.6% (top 54th percentile), there is no public exploit code or Nuclei template, the CVE is not in CISA KEV, and CISA's own SSVC decision is TRACK (monitor, not urgent). The requirement for authentication caps the blast radius to insiders, compromised accounts, or multi-tenant Flowise deployments where workspace users aren't fully trusted — which is a common pattern for AI agent-builder platforms shared across teams. The package's track record (156 other CVEs, OpenSSF/package risk score of 0/100) argues for treating any Flowise deployment as higher-risk than average and prioritizing patching over waiting for exploitation evidence.

How does the attack unfold?

Initial Access

An authenticated Flowise user creates or edits a Custom MCP node and sets its protocol to stdio.

AML.T0081

Exploitation

The attacker manipulates PYTHONWARNINGS/BROWSER environment variables (python3) or the working directory (node) to smuggle shell commands past validation.

AML.T0050

Execution

Flowise spawns the MCP subprocess with the attacker-controlled environment, executing arbitrary OS commands on the host.

AML.T0053

Impact

The attacker achieves full compromise of the Flowise host, exposing connected API keys, credentials, and enabling lateral movement.

AML.T0112

Initial Access

An authenticated Flowise user creates or edits a Custom MCP node and sets its protocol to stdio.

AML.T0081

Exploitation

The attacker manipulates PYTHONWARNINGS/BROWSER environment variables (python3) or the working directory (node) to smuggle shell commands past validation.

AML.T0050

Execution

Flowise spawns the MCP subprocess with the attacker-controlled environment, executing arbitrary OS commands on the host.

AML.T0053

Impact

The attacker achieves full compromise of the Flowise host, exposing connected API keys, credentials, and enabling lateral movement.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

1.1%

chance of exploitation in 30 days

Higher than 66% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Upgrade Flowise to version 3.1.3 or later immediately — this is the primary fix. Until patched, restrict Custom MCP node creation/editing to trusted administrators via RBAC, and disable or avoid stdio-protocol MCP node configurations where not strictly required. Run Flowise in an isolated container/VM with least-privilege OS permissions and no unnecessary outbound network access, so a successful RCE can't pivot laterally. For detection, monitor for unexpected python3/node child processes spawned by the Flowise service, unusual PYTHONWARNINGS/BROWSER environment variable values, or command execution from the Flowise working directory.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAgentPluginFrameworkAML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0081- Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system security controls

NIST AI RMF

MANAGE-2.3-Risks and benefits from third-party AI resources are regularly monitored

OWASP LLM Top 10

LLM07-Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-73601?

Flowise's Custom MCP node lets any authenticated user configure a stdio-based Model Context Protocol integration, and versions before 3.1.3 fail to properly validate the environment variables and working directory passed to that process — a logged-in user can smuggle shell commands through PYTHONWARNINGS/BROWSER (Python) or the working directory (Node) and achieve arbitrary code execution on the host running Flowise. This matters because Flowise sits at the center of many low-code AI agent deployments and requires only an ordinary authenticated account, not an admin, to trigger — turning a routine workspace login into full server compromise. Exploitation signals are currently modest: EPSS sits at 0.6% (top 54th percentile), there's no public exploit or Nuclei template, it isn't in CISA KEV, and CISA's SSVC verdict is TRACK rather than immediate action — but Flowise's history of 156 other CVEs should temper confidence in its default hardening. Patch to Flowise 3.1.3 or later now; until then, restrict who can create or edit Custom MCP nodes, disable stdio-protocol MCP integrations that aren't in active use, and run Flowise in an isolated, least-privilege container so a code-execution bug there can't reach the rest of your infrastructure.

Is CVE-2026-73601 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-73601, increasing the risk of exploitation.

How to fix CVE-2026-73601?

Upgrade Flowise to version 3.1.3 or later immediately — this is the primary fix. Until patched, restrict Custom MCP node creation/editing to trusted administrators via RBAC, and disable or avoid stdio-protocol MCP node configurations where not strictly required. Run Flowise in an isolated container/VM with least-privilege OS permissions and no unnecessary outbound network access, so a successful RCE can't pivot laterally. For detection, monitor for unexpected python3/node child processes spawned by the Flowise service, unusual PYTHONWARNINGS/BROWSER environment variable values, or command execution from the Flowise working directory.

What systems are affected by CVE-2026-73601?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI orchestration/workflow builders, MCP tool integrations.

What is the CVSS score for CVE-2026-73601?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI orchestration/workflow buildersMCP tool integrations

MITRE ATLAS Techniques

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0081Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and BROWSER environment variables with python3, or leverage the root working directory with node to bypass validation and execute system commands.

Exploitation Scenario

An attacker with a low-privilege but authenticated Flowise account creates or edits a Custom MCP node, sets CUSTOM_MCP_PROTOCOL to stdio, and crafts the PYTHONWARNINGS or BROWSER environment variables (for a python3-backed MCP server) — or manipulates the working directory (for a node-backed MCP server) — to inject arbitrary shell commands that execute when Flowise spawns the MCP subprocess. The attacker gains a shell on the Flowise host, harvests API keys and credentials for every connected LLM/vector-DB/tool integration configured in that instance, and uses that access to pivot into other systems the Flowise server can reach or to tamper with other users' agent workflows.

Weaknesses (CWE)

CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')Primary CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

CWE-95 — Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'): The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

[Architecture and Design, Implementation] If possible, refactor your code so that it does not need to use eval() at all.
[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis

Source: MITRE CWE corpus.