Flowise server takeover risk widens

A critical weakness in Flowise has exposed self-hosted AI workflow servers to full compromise, after technical details and working exploit code showed that a logged-in user could trigger command execution by importing a crafted chatflow.

The flaw, tracked as CVE-2026-40933, affects Flowise deployments before version 3.1.0 and carries a 9.9 severity score. It stems from the way Flowise handles Model Context Protocol, or MCP, configurations in its Custom MCP tool. A malicious configuration can abuse the stdio transport to cause the server to launch attacker-controlled commands, turning a normal workflow import into a remote code execution event.

Flowise is a widely used open-source platform for building AI agents, chatbots and large language model workflows through a visual drag-and-drop interface. Its popularity among developers and enterprises has made it a key part of the fast-growing AI orchestration ecosystem, where low-code tools are increasingly connected to databases, cloud services, internal APIs and credential stores.

The exploit path is significant because it does not require a victim to run a workflow after import. A malicious chatflow can contain a Custom MCP configuration that executes as the imported canvas loads and Flowise tries to enumerate available MCP actions. That process can spawn the configured command on the server, giving the attacker operating-system-level execution under the privileges of the Flowise process.

Successful exploitation could allow an attacker to read files, access stored secrets, steal API keys, alter workflows, reach connected services or pivot into other parts of an organisation’s infrastructure. In containerised deployments, the impact could be severe if the Flowise process runs with elevated privileges or has access to host resources, volumes, environment variables or cloud credentials.

The issue is classed as post-authentication, meaning an attacker needs a valid account or must persuade an authorised user to import a malicious chatflow. That still leaves a broad attack surface in collaborative environments where teams exchange templates, import community workflows or allow multiple users to create and edit flows. A compromised user account, malicious insider or poisoned workflow shared through developer channels could provide the route needed for exploitation.

Flowise Cloud is not considered affected where stdio MCP is disabled. The principal risk applies to self-hosted open-source and enterprise instances, especially those exposed to the internet or deployed without strict user controls. Administrators are being urged to upgrade at least to version 3.1.0 and to review whether later versions and configuration changes fully address their threat model.

Security researchers have warned that input validation alone may not be sufficient because stdio MCP is inherently capable of launching local processes. The safer approach for many production environments is to disable stdio MCP where it is not essential, restrict Custom MCP use to trusted administrators, isolate Flowise from sensitive networks and run it with the least privileges needed for normal operation.

The disclosure also raises wider concerns about how AI agent platforms handle plugin-like features. MCP has been adopted to help AI systems connect to tools, files, repositories and external services. Its stdio transport is useful for local integrations because it launches a configured process and communicates over standard input and output. That same design becomes dangerous when untrusted or lower-trust users can influence the command being launched on a shared server.

Flowise has faced separate security scrutiny over earlier remote code execution and file access weaknesses, including flaws linked to CustomMCP handling, CSV processing and file read/write tools. Those cases underline a recurring pattern in AI workflow platforms: features designed for flexibility can become high-impact attack paths when they evaluate code, execute commands or connect to privileged services without strong isolation.

The timing is sensitive for enterprises racing to deploy AI agents in customer support, software development, data analysis and workflow automation. Many of these deployments connect AI orchestration platforms to production data, SaaS accounts and internal systems. A vulnerability in the orchestration layer can therefore produce consequences beyond the application itself, particularly where credentials are stored centrally or integrations have broad permissions.

Mitigation should begin with identifying all Flowise instances, checking installed versions and reviewing whether MCP features are enabled. Organisations should audit imported chatflows, inspect access logs for unusual imports or workflow changes, rotate credentials that may have been exposed, and ensure containers are not running as root. Network exposure should be reduced through VPNs, private access controls or identity-aware proxies.