CVE-2026-56274: Flowise Custom MCP Server OS Command Injection
CVE-2026-56274 affects Flowise versions before 3.1.2 and is classified as OS command injection (CWE-78) in the Custom MCP Server feature. According to the record, a user with a Flowise account of any role, or API access with chatflow view/update permissions, can configure a malicious MCP server that bypasses the command-flag and local file access checks to run arbitrary commands on the host. The record reports a CVSS 3.1 base score of 9.9 and a CVSS 4.0 score of 8.7 from VulnCheck, and does not list CISA KEV status.
Overview
CVE-2026-56274 is a set of OS command injection issues in the Custom MCP Server feature of Flowise, an open-source platform for building AI workflows. The record attributes the problem to incomplete validation of command flags and a regular expression bypass in the restrictions on local file access. The vulnerability is tracked as CWE-78.
Impact
- The record states that successful exploitation results in execution of arbitrary commands on the Flowise host.
- The CVSS 3.1 vector in the record is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which indicates a network-reachable issue with low complexity, low privileges, no user interaction, scope change, and high confidentiality, integrity and availability impact.
- VulnCheck also published a CVSS 4.0 score of 8.7 in the record.
Affected products and versions
- Product: Flowiseai Flowise.
- Affected range in the record: versions before 3.1.2.
- The record does not list specific fixed-version entries. The stated range implies that 3.1.2 and later are outside the affected range, which is an inference.
Exploitation status
- The CISA KEV entry in the record is marked as not listed, so the record does not indicate active exploitation in the wild.
- One of the GitHub references is tagged as exploit-related. This tag does not by itself confirm exploitation in the wild, and no confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Upgrade Flowise to version 3.1.2 or later, which is the boundary given in the affected range.
- Until patching is complete, limit who can create or modify accounts and chatflows, and restrict API keys to the minimum permissions needed.
- Review which users can configure Custom MCP Servers and treat MCP server configuration as a privileged action.
- Isolate the Flowise host, limit its outbound network access and its access to sensitive files and credentials.
Detection guidance
- Review Flowise audit or application logs for recently created or modified MCP server configurations and unexpected chatflow changes.
- Monitor the Flowise host for unexpected child processes spawned by the Flowise service.
- Correlate account and API key activity with configuration changes to identify unauthorized use.
Limitations of the available information
- The record does not provide the full list of affected builds or the exact release notes for the fix.
- The record has no EPSS score and no SSVC data.
- The record does not describe the detailed technical conditions of exploitation beyond the summary, and this analysis does not provide exploitation steps.
- Vendor advisory content was not included in the record beyond the cited references.
Frequently asked questions
Which Flowise versions are affected by CVE-2026-56274?
The record lists Flowise versions before 3.1.2 as affected. It does not list specific fixed-version entries, so upgrading to 3.1.2 or later is the boundary indicated by the affected range.
Is CVE-2026-56274 known to be actively exploited?
The record shows the vulnerability is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted.
What should administrators do first?
Upgrade Flowise to 3.1.2 or later, restrict who can create accounts and modify chatflows, and review existing Custom MCP Server configurations for unexpected changes.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.