CVE-2025-71336

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.6

Description The Custom MCP feature, used for executing OS commands like launching local MCP servers, is unsandboxed. Due to a minimal authentication and authorization model lacking role-based access control, and the fact that default installations may run without authentication if FLOWISE USERNAME and FLOWISE PASSWORD are not configured, an attacker can execute arbitrary OS commands. This is achieved by sending a crafted JSON payload with the header x-request-from: internal to the '/api/v1/node-load-method/customMCP' endpoint, potentially leading to a complete compromise of the platform container or server.

Recommendations Update to version 3.0.6 or later. Set the FLOWISE USERNAME and FLOWISE PASSWORD variables to enable authentication. Restrict access to the '/api/v1/node-load-method/customMCP' endpoint.