AI Threat AlertCVE-2026-91932: Flowise: MCP cwd validation bypass enables RCE
HIGHPoC AVAILABLECISA: ATTENDFlowise before 3.1.4 fails to validate the working-directory (cwd) parameter in its MCP server configuration, so an authenticated user can point the server at a directory they control and run attacker-supplied code even though the args array looks clean. Exploitation needs a valid low-privilege account and a high-complexity setup, and the scope change in the CVSS vector (S:C) means a successful attack can reach beyond Flowise itself into the host and connected systems. The risk is moderate for now: EPSS is 0.73% (47th percentile), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC rates it ATTEND. Flowise often holds LLM provider keys, vector database credentials and other secrets, so a compromise would be costly. Upgrade to Flowise 3.1.4 or later, review who can configure MCP servers, and audit existing MCP server configurations for unexpected cwd values.
What is the risk?
High severity (CVSS 8.5) but with a limited near-term exploitation likelihood. EPSS is low (0.00734, top 47%), there is no KEV listing, no public exploit and no scanner template. Exploitation requires authentication (PR:L) and high attack complexity, which lowers opportunistic risk. The changed scope (S:C) and full C/I/A impact make it severe for any deployment where untrusted or low-trust users can hold accounts, such as multi-tenant or shared Flowise instances. CISA SSVC rates it ATTEND, so it should be handled on a prioritized but non-emergency timeline.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Flowise | npm | — | No patch |
Do you use Flowise? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade Flowise to 3.1.4 or later (see GHSA-x7x8-95gh-42xm and the VulnCheck advisory). 2) Until patched, restrict who can create or edit MCP server configurations, and remove access for untrusted or low-privilege accounts. 3) Run Flowise as a non-root user in a hardened container with a read-only filesystem where possible, and limit writable paths so attackers cannot stage files. 4) Segment Flowise from sensitive internal systems and restrict its egress. 5) Rotate LLM API keys, database credentials and other secrets stored in Flowise if suspicious MCP configuration changes are found. 6) Detection: audit MCP server configs for unusual cwd values, monitor for child processes spawned by the Flowise process, and alert on file writes to unexpected directories followed by process execution.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-91932?
Flowise before 3.1.4 fails to validate the working-directory (cwd) parameter in its MCP server configuration, so an authenticated user can point the server at a directory they control and run attacker-supplied code even though the args array looks clean. Exploitation needs a valid low-privilege account and a high-complexity setup, and the scope change in the CVSS vector (S:C) means a successful attack can reach beyond Flowise itself into the host and connected systems. The risk is moderate for now: EPSS is 0.73% (47th percentile), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC rates it ATTEND. Flowise often holds LLM provider keys, vector database credentials and other secrets, so a compromise would be costly. Upgrade to Flowise 3.1.4 or later, review who can configure MCP servers, and audit existing MCP server configurations for unexpected cwd values.
Is CVE-2026-91932 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2026-91932, increasing the risk of exploitation.
How to fix CVE-2026-91932?
1) Upgrade Flowise to 3.1.4 or later (see GHSA-x7x8-95gh-42xm and the VulnCheck advisory). 2) Until patched, restrict who can create or edit MCP server configurations, and remove access for untrusted or low-privilege accounts. 3) Run Flowise as a non-root user in a hardened container with a read-only filesystem where possible, and limit writable paths so attackers cannot stage files. 4) Segment Flowise from sensitive internal systems and restrict its egress. 5) Rotate LLM API keys, database credentials and other secrets stored in Flowise if suspicious MCP configuration changes are found. 6) Detection: audit MCP server configs for unusual cwd values, monitor for child processes spawned by the Flowise process, and alert on file writes to unexpected directories followed by process execution.
What systems are affected by CVE-2026-91932?
This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, LLM orchestration platforms, MCP server integrations, Low-code AI workflow builders, Multi-tenant AI platforms.
What is the CVSS score for CVE-2026-91932?
CVE-2026-91932 has a CVSS v3.1 base score of 8.5 (HIGH). The EPSS exploitation probability is 0.73%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0050Command and Scripting InterpreterAML.T0053AI Agent Tool InvocationAML.T0081Modify AI Agent ConfigurationAML.T0083Credentials from AI Agent ConfigurationCompliance Controls Affected
What are the technical details?
Original Advisory
Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working directory to execute malicious code.
Exploitation Scenario
An attacker with a low-privilege Flowise account (for example a compromised user, a trial account or a malicious insider) opens the MCP server configuration. They upload or write a malicious script into a directory they can write to, then create an MCP server entry whose args array holds only a clean-looking filename that passes path validation, while the cwd parameter points to the attacker-controlled directory. When Flowise starts the MCP server, the process runs the attacker's file with the privileges of the Flowise service. The attacker then reads stored API keys and credentials, pivots into connected data stores, and sets up persistence in the AI agent environment.
Weaknesses (CWE)
CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- [Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
- [Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2025-7133810.0Flowise: unauthenticated file write enables RCE
Same package: flowiseCVE-2025-5952810.0Flowise: Unauthenticated RCE via MCP config injection
Same package: flowiseCVE-2025-619139.9Flowise: path traversal in file tools leads to RCE
Same package: flowiseCVE-2026-409339.9Flowise: RCE via MCP stdio command injection
Same package: flowiseCVE-2026-464429.9Flowise: sandbox escape enables authenticated RCE
Same package: flowise