Flowise's implementation of the Model Context Protocol (MCP) via stdio servers contains a critical sandboxing vulnerability (CVE-2026-40933, CVSS 9.9) allowing post-authentication remote code execution. Attackers can trigger execution by importing a malicious chatflow, exploiting improperly validated MCP configurations to execute arbitrary operating system commands. Despite hardening attempts via PRs #5232, #5741, and #5943, researchers from Obsidian Security demonstrated that these input validation filters are trivially bypassable. Successful exploitation grants the attacker the privileges of the Flowise process, facilitating lateral movement to connected cloud environments, databases, and SaaS applications through exposed API keys and credentials.

• Vulnerability Mechanics: MCP Sandboxing Failure

  • The vulnerability resides in the MCP stdio server component, which is designed to allow AI agents to interact with local system processes.
  • Flowise failed to implement adequate architectural sandboxing for attacker-controlled MCP configurations, allowing protocol-level manipulation.
  • This failure enables the execution of arbitrary OS commands via manipulated stdio streams within the agent's context.

• Exploitation Vector: Malicious Chatflow Injection

  • The primary attack vector is the post-authentication import of a specially crafted, malicious chatflow file.
  • Attackers utilize a "one-click" mechanism, requiring minimal user interaction once a user has access to the Flowise instance.
  • The attack leverages the platform's automated processing of MCP configurations embedded directly within the imported workflow.

• Defensive Evasion: Ineffective Iterative Patching

  • Researchers identified that several hardening attempts (PRs #5232, #5741, and #5943) failed to address the underlying architectural flaw.
  • These mitigations relied on superficial input validation and security flags rather than true process isolation.
  • Sophisticated bypasses allow attackers to circumvent these filters by manipulating the underlying structure of the MCP protocol communications.

• Impact Assessment: Full System Compromise

  • Successful exploitation results in full command execution under the security privileges of the running Flowise process.
  • In containerized deployments, this poses a significant risk of root-level access and potential container escape.
  • The blast radius includes the theft of API keys and credentials, enabling lateral movement to connected cloud resources and SaaS applications.

• Remediation and Hardening Strategies

  • Immediate Mitigation: Configure the environment variable CUSTOM_MCP_PROTOCOL=sse to disable the vulnerable stdio-based MCP functionality.
  • Flowise Cloud deployments are inherently protected, as the stdio MCP feature is disabled by default in managed environments.
  • Self-hosted administrators must audit all imported chatflow configurations and transition to SSE-based (Server-Sent Events) protocols for MCP.