Flowise disclosed a critical remote code execution flaw, tracked as CVE-2026-56274 , affecting versions before 3.1.2 in the Custom MCP Server feature. The vulnerability stems from multiple OS command injection paths in validateCommandFlags and validateArgsForLocalFileAccess , allowing attackers to configure a malicious MCP server and execute arbitrary commands on the Flowise host. The issue is rated CVSS 9.9 and is remotely exploitable.
Advisories describe three bypass techniques: an incomplete Docker argument blocklist that permits docker build with a remote URL, an npx blocklist bypass where --yes is allowed even though -y is blocked, and a Unix path validation weakness that lets paths beginning with // evade local file access checks for node . Exploitation requires any Flowise account role or API access with view and update permissions for chatflows. Organizations were urged to upgrade to Flowise 3.1.2 or later, review MCP server configurations, and restrict chatflow management permissions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-56274 was published describing a critical remote code execution vulnerability in Flowise before version 3.1.2 caused by MCP security bypasses. The entry notes a CVSS 3.1 score of 9.9 and recommends upgrading to Flowise 3.1.2 or later.
A GitHub security advisory disclosed three bypass techniques in Flowise's Custom MCP Server feature that can lead to arbitrary command execution on the Flowise server. The advisory states the issues affect vulnerable code in validateCommandFlags and validateArgsForLocalFileAccess and require a Flowise account or API access with chatflow view/update permissions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the morning.
Ask questions this story and take action on the answers.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
