CVE-2026-91931: Flowise Custom MCP Node RCE Vulnerability

CVE-2026-91931 Overview

CVE-2026-91931 is a remote code execution vulnerability in Flowise versions before 3.1.4. The flaw resides in the Custom Model Context Protocol (MCP) node, which accepts attacker-controlled npx package names in the mcpServerConfig parameter. Authenticated attackers can supply arbitrary npm package names, causing the Flowise server to invoke npx and execute attacker-controlled code. The issue is classified under [CWE-78: OS Command Injection] and affects the low-code LLM orchestration platform used to build AI agents and workflows.

Critical Impact
Authenticated attackers can execute arbitrary code on the Flowise server, leading to full host compromise, data theft, and lateral movement into connected AI infrastructure.

Affected Products

Flowise versions prior to 3.1.4
Deployments exposing the Custom MCP node to authenticated users
Self-hosted Flowise instances with default MCP configuration enabled

Discovery Timeline

2026-09-15 - CVE-2026-91931 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91931

Vulnerability Analysis

Flowise is an open-source, drag-and-drop tool for building large language model (LLM) applications and agents. The Custom MCP node lets users integrate external Model Context Protocol servers into their workflows. To launch these servers, Flowise passes user-supplied configuration to the npx command-line utility.

The mcpServerConfig parameter accepts an npm package name that Flowise then executes through npx. Because npx will download and run any published npm package on demand, an authenticated user can specify an attacker-controlled package. The package's install and runtime scripts execute in the context of the Flowise process, producing arbitrary code execution on the host.

This vulnerability weakens the trust boundary between authenticated Flowise users and the underlying operating system. In multi-tenant or shared environments, any account with permission to create or edit MCP nodes becomes a path to full server compromise.

Root Cause

The root cause is missing validation and sanitization of the mcpServerConfig package name before it is passed to npx. Flowise treats authenticated input as trusted and delegates package resolution and execution to npx, which by design fetches and runs arbitrary npm packages.

Attack Vector

An attacker authenticates to a vulnerable Flowise instance, creates or modifies a Custom MCP node, and sets mcpServerConfig to reference a malicious npm package under their control. When Flowise instantiates the node, npx downloads the package and executes its scripts, giving the attacker code execution on the server.

The vulnerability manifests when Flowise spawns npx with the attacker-supplied package identifier. Refer to the GitHub Security Advisory GHSA-vcwp-f9rq-3887 and the Vulncheck Remote Code Execution Advisory for the technical breakdown.

Detection Methods for CVE-2026-91931

Indicators of Compromise

Unexpected npx or node child processes spawned by the Flowise service account
Outbound network connections from the Flowise host to the npm registry (registry.npmjs.org) followed by connections to unfamiliar command-and-control endpoints
New or modified Custom MCP nodes containing unusual package names in mcpServerConfig
Files written to ~/.npm/_npx/ or temporary directories immediately before suspicious process activity

Detection Strategies

Baseline the set of npm packages legitimately used by Flowise MCP workflows and alert on deviations
Inspect Flowise application logs and database entries for MCP node configurations referencing untrusted or newly published packages
Correlate authentication events with subsequent MCP node creation and process execution to identify abuse chains

Monitoring Recommendations

Enable process creation logging on Flowise hosts and forward events to a centralized analytics platform
Monitor egress traffic from Flowise servers to the npm registry and public code-hosting services
Alert on Flowise API requests that create or update Custom MCP nodes, particularly from newly created or low-privileged accounts

How to Mitigate CVE-2026-91931

Immediate Actions Required

Upgrade Flowise to version 3.1.4 or later without delay
Audit all existing Custom MCP node configurations and remove entries referencing untrusted packages
Rotate credentials, API keys, and tokens stored on any Flowise host suspected of compromise
Restrict Flowise administrative access to trusted operators and enforce strong authentication

Patch Information

The Flowise maintainers addressed the vulnerability in version 3.1.4. Details are published in the GitHub Security Advisory GHSA-vcwp-f9rq-3887. Operators running self-hosted Flowise should pull the updated container image or upgrade the npm package immediately.

Workarounds

Disable the Custom MCP node type for tenants that do not require it until the upgrade is applied
Run Flowise in a hardened container with no outbound access to the npm registry
Enforce network egress filtering to block package downloads from arbitrary sources
Apply least-privilege file system and process permissions to the Flowise service account

bash

# Configuration example: run Flowise with restricted egress and non-root user
docker run -d \
  --name flowise \
  --user 1000:1000 \
  --read-only \
  --cap-drop=ALL \
  --network flowise-restricted \
  -e DISABLE_FLOWISE_TELEMETRY=true \
  flowiseai/flowise:3.1.4