Tracking: CVE-2026-91931
Severity: High
Who is affected
Flowise before 3.1.4. An authenticated attacker must be able to supply the affected Custom MCP node's mcpServerConfig.
How the attack works
The Custom MCP node uses the supplied npm package name to start a server with npx. Selecting an attacker-controlled package causes its code to run on the Flowise host as part of process startup. A package name in this configuration therefore grants executable authority, rather than merely identifying a remote data source.
Execution inherits the Flowise service account's access, including available flow configuration, files, and credentials.
What to do
- Upgrade to 3.1.4 or later and restart affected instances.
- Review Custom MCP node definitions for unfamiliar package names or changes made by unexpected users. Check package execution and child-process logs.
- Limit configuration privileges and use reviewed MCP packages with constrained runtime access. Rotate accessible secrets if investigation indicates malicious package execution.
Scope and limits
The related working-directory bypass, CVE-2026-91932, has different input conditions. Both require attention when reviewing pre-3.1.4 deployments.