Vulnerability Description
Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API access with view/update permissions for chatflows, can configure a malicious MCP server to bypass the validateCommandFlags blocklist (for example, 'docker build' is not blocked, and 'npx --yes' is not blocked while only '-y' is) and the validateArgsForLocalFileAccess checks, resulting in execution of arbitrary commands on the Flowise host.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flowiseai | Flowise | < 3.1.2 |
Related Weaknesses (CWE)
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-m99r-2hxc-cp3qExploitThird Party Advisory
- https://www.vulncheck.com/advisories/flowise-remote-code-execution-via-mcp-securThird Party Advisory
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-m99r-2hxc-cp3qExploitThird Party Advisory
FAQ
What is CVE-2026-56274?
CVE-2026-56274 is a vulnerability with a CVSS score of 9.9 (CRITICAL). Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restricti...
How severe is CVE-2026-56274?
CVE-2026-56274 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-56274?
Check the references section above for vendor advisories and patch information. Affected products include: Flowiseai Flowise.