One Click, Full Shell: Flowise MCP Flaw Scores 9.9 CVSS
A sandboxing failure in Flowise's MCP stdio implementation lets an attacker execute arbitrary OS commands with process-level privileges — and the patches so far don't close the hole.
Self-hosted Flowise deployments are carrying a 9.9-CVSS remote code execution flaw, and the fixes shipped so far have not resolved the root cause. Researchers at Obsidian Security published a detailed breakdown of CVE-2026-40933, which lives inside Flowise's implementation of Model Context Protocol stdio servers.
The mechanism is straightforward and ugly. MCP's stdio transport is designed to spawn local processes and pipe data through stdin/stdout — legitimate enough when you control what gets spawned. Flowise lets authenticated users supply arbitrary MCP stdio configurations, which means they can also supply arbitrary OS commands. Those commands run with whatever privileges the Flowise process holds. In containerized environments, Obsidian notes, that frequently means root inside the container, with everything the platform can reach exposed: API keys, databases, cloud credentials, connected SaaS applications.
The "one click" framing is accurate. A malicious chatflow can be imported and trigger execution before a user saves or runs anything. No additional interaction required.
Flowise responded across several patch iterations. PR #5232 introduced CUSTOM_MCP_SECURITY_CHECK, a default-enabled validation layer meant to block dangerous command patterns. PRs #5741 and #5943 added further flag validation. Obsidian's verdict on all of it: insufficient. The checks filter known-bad patterns rather than address the structural problem, which is that users can supply stdio configurations at all. The researchers published proof-of-concept code demonstrating bypass of the current controls.
When Obsidian asked Flowise to treat stdio MCP as opt-out by default, the project reportedly declined, citing a preference to "limit what we know is bad without completely disabling features that users may rely on." That's a reasonable product tension. It's also a position that leaves a 9.9-severity attack surface open for deployments where administrators haven't read the advisory.
Flowise Cloud is unaffected — stdio MCP is disabled there. The risk is entirely on self-hosted instances.
The only complete mitigation Obsidian recommends is setting CUSTOM_MCP_PROTOCOL=sse, which disables stdio MCP entirely. For operators who can't do that without breaking workflows, the researchers suggest pinning trusted packages and auditing every imported chatflow from untransted sources. That second control is meaningful: the import vector means a developer sharing a chatflow file is a potential delivery mechanism.
Flowise powers internal AI assistants, RAG pipelines, customer-facing chatbots, and autonomous agents wired into business systems. The blast radius of a successful exploit scales directly with how much those agents can touch. Self-hosted deployments should treat this as urgent.
