GHSA-m99r-2hxc-cp3q: Flowise has an MCP Security Bypass that Enables RCE

Summary

Flowise's MCP feature contains a security bypass chain that lets an attacker run arbitrary commands on the host. The validateCommandFlags blocklist in packages/components/nodes/tools/MCP/core.ts omits docker build, so a Custom MCP Server configured as docker build <remote-URL> pulls and runs a remote Dockerfile. A second bypass uses the long alias --yes, which is not blocked for npx, letting npx install and execute an attacker-supplied npm package. The attacker needs a Flowise account of any role or an API key with view and update permissions for chatflows, and the server must have the docker or npx command available.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12
• flowise-componentsnpmLLM dependency since 2023-04-10 · 1 tracked dependent

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
• CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySimilar attack · NVD/CVE Database
• MediumCVE-2026-123851: JetBrains Junie GitHub Action prompt injection bypass via HTML encodingSimilar attack · NVD/CVE Database