CVE-2026-69263: Flowise Custom MCP Server RCE Vulnerability

CVE-2026-69263 Overview

CVE-2026-69263 is a high-severity vulnerability in Flowise, a drag-and-drop interface for building large language model workflows. The flaw affects versions prior to 3.1.3 and stems from an incomplete environment variable denylist in the Custom MCP (Model Context Protocol) server component. Attackers with low-privilege access can bypass the mitigation introduced for CVE-2025-8943 by setting npm_config_yes=true, which causes npx to auto-install and execute arbitrary packages without using the previously blocked -y or --yes flags.

Critical Impact
Authenticated attackers can achieve arbitrary code execution on the Flowise server by launching a Custom MCP configuration that triggers npx to fetch and run attacker-controlled npm packages.

Affected Products

Flowise versions prior to 3.1.3
packages/components/nodes/tools/MCP/core.ts Custom MCP server component
Deployments enabling CUSTOM_MCP_PROTOCOL=stdio

Discovery Timeline

2026-08-04 - CVE-2026-69263 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-69263

Vulnerability Analysis

The vulnerability is an incomplete denylist flaw [CWE-184] in the Custom MCP server launcher. The prior fix for CVE-2025-8943 blocked the -y and --yes command-line flags on npx invocations. However, packages/components/nodes/tools/MCP/core.ts restricted only four environment variables by exact name: PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS.

npm reads configuration from any environment variable prefixed with npm_config_. Setting npm_config_yes=true reproduces the --yes behavior of npx, causing auto-installation and execution of the referenced package. The denylist never accounted for this configuration channel, allowing attackers to trigger arbitrary package execution on the host.

Root Cause

The root cause is reliance on an incomplete denylist rather than an allowlist of permitted environment variables. Filtering by exact variable name misses the entire npm_config_* namespace that npm treats as authoritative configuration input.

Attack Vector

An authenticated user configures a Custom MCP server using the stdio protocol. The user supplies environment variables including npm_config_yes=true along with a package name pointing to an attacker-controlled npm module. When Flowise launches the MCP process, npx silently downloads and executes the package under the Flowise service account.

text

# Patch excerpt from docker/.env.example (a4c4e49)
# CUSTOM_MCP_SECURITY_CHECK=true
- # CUSTOM_MCP_PROTOCOL=sse #(stdio | sse)
+ # CUSTOM_MCP_PROTOCOL=sse #(stdio | sse) 'stdio' can run arbitrary commands on your server, enable only if you trust all users
+ # CUSTOM_MCP_ALLOWED_ENV_VARS= #(comma-separated list of env var names a Custom MCP stdio config may set, e.g. BRAVE_API_KEY,GITHUB_TOKEN. Empty = none allowed)

Source: Flowise commit a4c4e49. The fix replaces the denylist model with an explicit allowlist controlled by CUSTOM_MCP_ALLOWED_ENV_VARS.

Detection Methods for CVE-2026-69263

Indicators of Compromise

Custom MCP configurations containing environment variables matching the pattern npm_config_*, particularly npm_config_yes
Unexpected npx child processes spawned by the Flowise Node.js runtime referencing unfamiliar package names
Outbound network connections from Flowise hosts to the npm registry (registry.npmjs.org) at runtime
New files under ~/.npm/_npx/ or the npm cache directory belonging to the Flowise service account

Detection Strategies

Inspect stored MCP server configurations in the Flowise database for environment variable keys beginning with npm_config_
Monitor process creation events where the parent is the Flowise Node process and the child is npx, npm, or a package binary
Alert on Flowise service accounts initiating installs or executing binaries fetched from the npm registry outside deployment windows

Monitoring Recommendations

Enable audit logging for Custom MCP server creation and modification events
Forward Flowise container or host process telemetry to a centralized analytics platform for behavioral review
Track egress traffic from Flowise workloads to package registries and flag first-seen packages

How to Mitigate CVE-2026-69263

Immediate Actions Required

Upgrade Flowise to version 3.1.3 or later without delay
Set CUSTOM_MCP_PROTOCOL=sse unless all users of the instance are fully trusted
Restrict CUSTOM_MCP_ALLOWED_ENV_VARS to the minimum set of environment variables required by legitimate integrations
Review existing Custom MCP configurations and remove any containing npm_config_* variables

Patch Information

The fix is available in Flowise release 3.1.3. Technical details are documented in GHSA-xc48-889x-5qmw and pull request #6471. The patch introduces an allowlist model via CUSTOM_MCP_ALLOWED_ENV_VARS and adds warnings about the stdio protocol.

Workarounds

Disable the stdio Custom MCP protocol by setting CUSTOM_MCP_PROTOCOL=sse in the Flowise environment
Restrict Flowise administrative access to trusted operators only, since Custom MCP configuration requires authentication
Run Flowise in an isolated container with no outbound access to public package registries
Enforce egress filtering to block connections from the Flowise host to registry.npmjs.org where npm installs are not required at runtime

bash

# Configuration example for docker/.env after upgrading to 3.1.3
CUSTOM_MCP_SECURITY_CHECK=true
CUSTOM_MCP_PROTOCOL=sse
CUSTOM_MCP_ALLOWED_ENV_VARS=