CVE-2026-91932 in Flowise
Summary
by MITRE • 09/15/2026
Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working directory to execute malicious code.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The security flaw identified in Flowise versions prior to 3.1.4 represents a critical server-side request forgery and remote code execution vulnerability rooted in improper input validation within the Model Context Protocol server configuration module. This issue specifically targets the handling of the current working directory parameter during the initialization or operation of MCP servers. The vulnerability arises because the application fails to adequately sanitize or validate the path components provided by authenticated users before utilizing them for file system operations or process execution contexts. While basic filename validation may be present, it is insufficient against sophisticated attacks that manipulate the broader context in which those files are executed, specifically the working directory environment variable.
From a technical perspective, the core of this vulnerability lies in the separation between name-based validation and path-contextual security controls. An authenticated attacker can supply clean-looking filenames within the arguments array to bypass superficial checks designed to prevent obvious injection attempts or access to restricted system paths. However, by simultaneously controlling the working directory parameter, the attacker effectively shifts the reference point for relative path resolution. This allows the execution engine to resolve malicious scripts or binaries located in arbitrary directories as if they were legitimate components of the intended service. The lack of strict canonicalization and absolute path enforcement means that even valid-looking inputs can lead to unintended side effects when combined with a manipulated environment context, leading directly to remote code execution under the privileges of the Flowise process.
The operational impact of this vulnerability is severe due to its potential for full system compromise. Since authenticated users are able to trigger arbitrary command execution through the MCP server configuration interface, an attacker who has obtained valid credentials can escalate their access significantly beyond normal application boundaries. This could result in unauthorized data exfiltration, modification or destruction of critical application files, and further lateral movement within the internal network infrastructure where Flowise is deployed. The ability to execute code as the service account often grants privileges that allow for persistent backdoors, credential harvesting from memory, or exploitation of other local vulnerabilities present on the host system.
This vulnerability aligns with Common Weakness Enumeration category CWE-20 Improper Input Validation and more specifically CWE-78 OS Command Injection when considering the outcome of exploiting the working directory manipulation. In terms of tactical classification under MITRE ATT&CK, this behavior corresponds to T1546 Event Triggered Execution, particularly mechanisms involving environment variable modification or path traversal techniques that allow for privilege escalation and command execution without direct user interaction beyond initial authentication. The attack vector is classified as Network with Authentication required, indicating it cannot be exploited remotely by unauthenticated actors but poses a high risk in environments where credential theft or insider threats are prevalent concerns.
To mitigate this vulnerability, organizations must immediately upgrade Flowise to version 3.1.4 or later, which addresses the validation logic for MCP server configurations and enforces stricter controls on working directory parameters. In addition to patching, it is advisable to implement defense-in-depth strategies such as running the application with least-privilege principles to limit the impact of any potential code execution. Input validation should be enhanced to enforce absolute paths where possible or strictly whitelist allowed directories rather than relying solely on filename sanitization. Furthermore, monitoring for unusual process creation events originating from the Flowise service account can help detect exploitation attempts in real-time before significant damage occurs.