PT-2026-52615 · Flowise · Flowise

Assaf-Levkovich-Jf · Published 2026-06-25 · Updated 2026-06-25 · CVE-2025-71336

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless FLOWISE USERNAME and FLOWISE PASSWORD are set, an attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, resulting in complete compromise of the platform container or server.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-71336

Affected Products

Flowise

References · 3

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6933-jpx5-q87q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71336 · Security Note
• https://vulncheck.com/advisories/flowise-unsandboxed-remote-code-execution-via-custom-mcp · Note