CVE-2026-73601: Flowise before 3.1.3 Remote Code Execution via Custom MCP
Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and BROWSER environment variables with python3, or leverage the root working directory with node to bypass validation and execute system commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
flowiseto a version that resolves this vulnerability.Fixed in 3.1.3 - Configuration
For Flowise deployments, avoid using the Custom MCP configuration where CUSTOM_MCP_PROTOCOL is set to "stdio", since this configuration enables authenticated users to abuse environment variables/command arguments to execute arbitrary commands; use a non-stdio protocol instead.
Flowise Custom MCP node CUSTOM_MCP_PROTOCOL = stdio (do not use)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73601?
CVE-2026-73601 has a risk rating of 72, indicating a significant threat level.
How do I fix CVE-2026-73601?
To remediate CVE-2026-73601, upgrade Flowise to version 3.1.3 or later.
What is the impact of CVE-2026-73601?
CVE-2026-73601 allows authenticated users to execute arbitrary commands remotely through the Custom MCP node.
Who is affected by CVE-2026-73601?
Users of Flowise versions prior to 3.1.3 are vulnerable to CVE-2026-73601.
Is CVE-2026-73601 easy to exploit?
Yes, CVE-2026-73601 can be exploited by manipulating environment variables and command arguments by authenticated users.