CVE-2026-91932 Overview
CVE-2026-91932 is an input validation vulnerability [CWE-20] in Flowise versions before 3.1.4. The flaw resides in the Model Context Protocol (MCP) server configuration handler, which fails to validate the cwd (current working directory) parameter. Authenticated attackers can supply a clean filename in the args array while pointing cwd to an attacker-controlled directory, achieving remote code execution on the host running Flowise.
Critical Impact
Authenticated remote attackers can execute arbitrary code on the Flowise host by abusing an unvalidated cwd parameter in MCP server configuration, compromising confidentiality, integrity, and availability.
Affected Products
- Flowise versions prior to 3.1.4
- Flowise MCP server configuration component
- Deployments exposing Flowise to authenticated users
Discovery Timeline
- 2026-09-15 - CVE-2026-91932 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-91932
Vulnerability Analysis
Flowise is an open-source visual builder for LLM applications that supports MCP server integrations. When an authenticated user configures an MCP server, Flowise accepts a command, an args array, and a cwd parameter that sets the working directory for the spawned process. The validation logic inspects filenames in the args array to block obviously malicious payloads but omits any validation of the cwd value.
An attacker submits a benign-looking filename such as a common script name in args while directing cwd to a directory containing a file of that same name under attacker control. When Flowise spawns the process, the operating system resolves the executable or script relative to the attacker-controlled working directory, executing the malicious payload with the privileges of the Flowise process.
Root Cause
The root cause is incomplete input validation. Path validation is applied to the args array in isolation, without considering that the cwd parameter changes the resolution context for those arguments. This mismatch between the trust decision and the runtime behavior enables the bypass.
Attack Vector
Exploitation requires network access to the Flowise interface and low-privilege authenticated access sufficient to configure MCP servers. The attacker stages a payload in a writable directory reachable from the Flowise host, then submits an MCP configuration that sets cwd to that directory and references the payload filename in args. Triggering the MCP server invocation executes the payload. See the Flowise GitHub Security Advisory and the VulnCheck Remote Code Execution Advisory for additional context.
Detection Methods for CVE-2026-91932
Indicators of Compromise
- MCP server configuration entries containing non-standard cwd values pointing to /tmp, user home directories, or upload directories
- Unexpected child processes spawned by the Flowise Node.js runtime
- Outbound network connections from the Flowise host to unfamiliar destinations following MCP configuration changes
- New or modified executable files in directories writable by the Flowise service account
Detection Strategies
- Audit Flowise application logs for MCP server create and update events, correlating the cwd parameter against an allowlist of approved directories
- Monitor process creation telemetry for the Flowise parent process spawning shells, interpreters, or binaries from non-standard paths
- Inspect filesystem activity for writes to directories later referenced as cwd values in MCP configurations
Monitoring Recommendations
- Enable verbose audit logging on the Flowise instance and forward events to a centralized SIEM for retention and correlation
- Alert on any MCP configuration change performed by non-administrative accounts
- Baseline expected child processes of the Flowise runtime and alert on deviations
How to Mitigate CVE-2026-91932
Immediate Actions Required
- Upgrade Flowise to version 3.1.4 or later without delay
- Rotate credentials and API keys stored in or accessible to the Flowise instance if compromise is suspected
- Review MCP server configurations created before the upgrade and remove any with suspicious cwd values
- Restrict Flowise administrative access to trusted users and require multi-factor authentication
Patch Information
The vendor fixed the vulnerability in Flowise 3.1.4 by adding validation of the cwd parameter alongside the existing args validation. Refer to the Flowise GitHub Security Advisory GHSA-x7x8-95gh-42xm for the official patch details and upgrade instructions.
Workarounds
- Place Flowise behind an authenticated reverse proxy and limit network exposure to trusted internal ranges
- Run the Flowise process under a dedicated unprivileged service account with a read-only filesystem where feasible
- Disable or restrict MCP server functionality until the upgrade to 3.1.4 is completed
- Apply container or systemd-level restrictions preventing the Flowise process from executing binaries outside an allowlisted set of paths
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
