CVE-2026-91932

Flowise before version 3.1.4 contains an improper input validation flaw (CWE-20) in its MCP (Model Context Protocol) server configuration handling, rated critical at CVSS 4.0 9.0. An authenticated attacker can supply an unvalidated cwd (working directory) parameter combined with clean, non-suspicious filenames in the args array to bypass path validation and achieve remote code execution on the host running Flowise. Successful exploitation gives the attacker full control of the server process with high impact to confidentiality, integrity, and availability, and potential compromise of downstream systems and data the deployment can reach. Any organization running a self-hosted Flowise instance earlier than 3.1.4 that exposes MCP server configuration to lower-privileged authenticated users is affected. There is no known public proof of concept and the vulnerability is not on the CISA KEV list, so exploitation status is currently none known.

What to do: Upgrade Flowise to version 3.1.4 or later, which fixes the cwd validation bypass. Until patched, restrict access so only fully trusted administrators can create or modify MCP server configurations, and avoid exposing Flowise management interfaces to the internet. Review existing MCP server configurations for unexpected cwd values or args entries, and check host logs for suspicious child process execution originating from the Flowise process.