CVE: CVE-2026-56274 | CVSS 3.1: 9.9 (CRITICAL) | CWE: CWE-78 | Vendor: FlowiseAI | Product: Flowise | Affected versions: < 3.1.2
What Is the Vulnerability
Flowise is an open-source low-code platform for building LLM application flows and AI agents. The Custom MCP Server feature contains multiple OS command injection vulnerabilities due to incomplete command-flag validation and a regex bypass in local file access restrictions.
Any Flowise user, regardless of role, can exploit this vulnerability. Additionally, anyone with API view or update permissions can trigger the command injection. An attacker can inject arbitrary operating system commands through crafted MCP server configurations, leading to full remote code execution on the underlying host.
This marks the fourth AI framework and tool vulnerability disclosed in this period, following critical issues in Mastra (supply chain), LiteLLM, and AutoGen Studio. The concentration of vulnerabilities across the AI/LLM tooling ecosystem underscores the immaturity of security practices in this rapidly expanding domain.
Versions Affected
- Flowise versions prior to 3.1.2
Exploited?
There is NO known active exploitation of CVE-2026-56274 in the wild at this time. However, given the critical severity (CVSS 9.9), the low complexity of exploitation, and the widespread deployment of Flowise in AI/LLM environments, the likelihood of near-term exploitation is high. Organizations should prioritize patching immediately.
Fix
Upgrade to Flowise version 3.1.2 or later, which includes comprehensive input sanitization, proper command-flag validation, and a hardened regex for local file access restrictions. The patch addresses all identified OS command injection vectors in the Custom MCP Server feature.
Recommendations
- Upgrade Flowise to version 3.1.2+ immediately on all instances.
- Audit MCP server configurations for any signs of tampering or injected commands.
- Restrict API access to trusted users and networks; apply principle of least privilege.
- Monitor Flowise host systems for unexpected process execution or outbound connections.
- Consider network segmentation for Flowise instances in production environments.
References
Part of the Vulnerability Intelligence series on threat-modeling.com. See the June 24, 2026 Vulnerability Intelligence Report for broader context.
