CVE-2025-8943

Flowise's Custom MCPs feature launches local MCP servers by executing operating-system commands (for example via npx), but Flowise has a minimal authentication and authorization model with no role-based access controls, and versions before 3.0.1 run without authentication by default unless it is explicitly configured. As a result, an unauthenticated attacker with network access to an affected instance can invoke this functionality to run unsandboxed OS commands. Successful exploitation yields full unauthenticated remote code execution on the host with the privileges of the Flowise service, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 9.8). Any Flowise deployment prior to 3.0.1 is affected, with default, unauthenticated installations reachable from untrusted networks at greatest risk. JFrog has published technical details and a PoC, EPSS assigns a 66.3% probability of exploitation within 30 days (99th percentile), and news coverage reports active exploitation with 12,000+ instances exposed on the internet.

What to do: Upgrade Flowise to version 3.0.1 or later. Until upgraded, restrict network access to the instance (firewall rules or an authenticating reverse proxy) and explicitly enable authentication, since default installations before 3.0.1 run without it. Review internet-exposed instances for signs of compromise, such as unexpected npx launches or child OS processes spawned by the Flowise service.