Tracking: CVE-2026-91932
Severity: High
Who is affected
Flowise before 3.1.4. The attacker needs authenticated access to the affected MCP configuration path and control of its working directory.
How the attack works
Validation checks can accept apparently safe filenames in the argument array while overlooking the caller-controlled cwd. Changing where the command runs can change which files or executables those relative arguments resolve to.
The reported bypass reaches remote code execution on the Flowise host. It illustrates why validating argument text alone is insufficient when the process's working directory remains under attacker control.
What to do
- Upgrade to 3.1.4 or later and restart Flowise.
- Review saved MCP configurations for unexpected working directories, relative executable paths, and files placed in those directories.
- Restrict who may change MCP process settings and run Flowise with limited filesystem and credential access. Investigate suspicious child processes before re-enabling affected configurations.
Scope and limits
Authentication is an exploitation prerequisite. This is separate from the related Custom MCP package-selection issue, CVE-2026-91931, fixed in the same release.