CVE-2026-73601

Executive Summary

CVE-2026-73601 is a remote code execution (RCE) vulnerability in Flowise versions before 3.1.3, residing in the Custom MCP node when the CUSTOM_MCP_PROTOCOL option is set to stdio. An authenticated user can manipulate environment variables and command arguments passed to child processes spawned by the node, allowing the execution of arbitrary operating system commands. Successful exploitation yields full command execution in the context of the Flowise application server, potentially leading to data exfiltration, credential theft, lateral movement, or full host compromise. No CVSS score, public exploit, or CISA KEV inclusion exists as of this report; the sole patch claim (Flowise 3.1.3) originates from OSV and is not independently confirmed.

Technical Analysis

Flowise is an open-source, low-code platform built on Node.js for building LLM (large language model) applications and AI agents. Its Custom MCP node integrates Model Context Protocol (MCP) servers, allowing Flowise flows to connect to external tooling. When configured with CUSTOM_MCP_PROTOCOL set to stdio, the node spawns a local child process (for example, an MCP server binary) and communicates with it over standard input/output streams.

The vulnerability class is CWE-95 — Improper Neutralization of Directives in Dynamically Evaluated Code (commonly referred to as code injection / eval injection). The flaw lies in the node's failure to sanitize the environment variables and command arguments passed to the spawned child process. Because these values are derived from user input without adequate validation, an authenticated user can inject operating-system directives that the runtime interpreter or shell subsequently evaluates.

The NVD description identifies two distinct abuse paths:

1. Python interpreter abuse via environment variables: An attacker with access to the Custom MCP configuration can set the PYTHONWARNINGS and BROWSER environment variables when spawning python3. These variables are not treated as inert data — PYTHONWARNINGS is parsed by the Python interpreter during startup, and BROWSER is an OS-level variable consulted by various utilities to locate a browser executable. By crafting these values, the attacker can cause the interpreter or a dependent utility to execute attacker-controlled commands rather than benign configuration data. This is a classic environment-variable injection pattern where variables that influence process behavior are repurposed to carry executable payloads.

2. Node.js root working-directory bypass: An alternative path leverages node as the spawned process. By setting the working directory to the filesystem root, the attacker bypasses directory-based validation/allowlisting logic that would otherwise restrict which scripts or modules the Node.js process may load or evaluate. Once the working-directory constraint is removed, the attacker can point the node process at attacker-influenced JavaScript located elsewhere on the filesystem (or cause the process to evaluate attacker-supplied input), resulting in arbitrary code execution.

The attack surface is the authenticated web UI/API of Flowise: the vulnerability requires a user who can create or modify a flow containing the Custom MCP node. The underlying flaw is not in the MCP protocol itself but in how Flowise composes the child process launch (command, arguments, environment, working directory) from user-controlled fields. The lack of input validation, combined with the elevated privileges of the Flowise server process, turns a configuration feature into an RCE primitive.

Insufficient technical detail is available to name the exact validation function or configuration object schema, and no source-level patch diff has been independently confirmed. The analysis above is constrained strictly to the behavior described in the NVD entry and the general mechanics of CWE-95.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class and the NVD description. No public PoC or exploit-in-the-wild evidence is available; the scenario below describes the realistic end-to-end chain.

Step 1 — Reconnaissance / target identification An attacker first identifies an internet-exposed Flowise instance, commonly running on port 3000. Indicators include the Flowise web UI title/branding, API responses, or default HTTP headers. Shodan searches such as http.title:"Flowise" or port:3000 http.title:"Flowise" can surface candidate targets. The attacker then determines whether an account with flow-editing privileges is required and either obtains valid credentials (e.g., via phishing, credential stuffing, or default credentials) or, in deployments with open registration, creates an account.

Step 2 — Triggering the flaw class The attacker authenticates and navigates to the Custom MCP node configuration within a flow designer. They set CUSTOM_MCP_PROTOCOL to stdio, which instructs the node to spawn a local process. The attacker supplies the command (python3 or node), command-line arguments, environment variables, and, where exposed, the working directory — the exact fields that the vulnerable code passes to the process spawn without adequate validation. At this point the attacker has already placed injected directives inside fields that should contain only benign configuration data.

Step 3 — Payload execution (vulnerability-class level)

• With python3: the attacker sets hostile values for PYTHONWARNINGS and/or BROWSER. Because these environment variables are interpreted at interpreter or process-launch time, the values cause the spawned Python process or a utility invoked by it to execute attacker-controlled system commands (e.g., reverse shell, file read, or payload download) instead of benign MCP server behavior.
• With node: the attacker sets the working directory to the filesystem root (/), bypassing the node's directory-based validation. The node process is then persuaded to load and evaluate attacker-influenced JavaScript from a location that the validation logic previously disallowed, yielding arbitrary code execution within the Node.js runtime. The injection manifests through the process spawn parameters — no separate deserialization or memory-corruption primitive is required; the vulnerability is a direct command/code-injection defect.

Step 4 — Post-exploitation impact Once code execution is achieved, the attacker operates with the privileges of the Flowise server process (typically a dedicated or containerized user, but often with access to the host filesystem and network). Common follow-on actions include: reading environment variables and configuration files to harvest API keys and LLM provider credentials; querying the Flowise internal database for user hashes and flow definitions; establishing persistence via cron, SSH keys, or injected startup scripts; and using the host as a pivot point for lateral movement into the internal network. Because Flowise deployments frequently integrate with cloud LLM APIs and internal services, the credential value exposed is significant.

Impact Assessment

The business impact of CVE-2026-73601 is critical by nature, though no CVSS score has been officially assigned (CVSS Vector: N/A) and no weighted subscores are available from NVD. The EPSS score is 0.00606 (46.1% percentile of exploited CVEs), indicating that while mass exploitation has not been observed, the vulnerability is squarely within the population of CVEs that attackers actively scan for — likely due to the growing adoption of LLM orchestration platforms.

• Confidentiality: Arbitrary command execution enables reading of any file accessible to the Flowise process, including LLM API keys, database connection strings, and MCP server credentials. These secrets frequently unlock downstream cloud infrastructure, amplifying the breach.
• Integrity: An attacker can modify flows, tamper with pipeline logic, inject malicious tools into agent workflows, or alter application files on the host — enabling supply-chain style manipulation of the AI application output.
• Availability: Full host-level command execution permits process termination, disk destruction, or ransomware deployment, converting the Flowise instance into a beachhead for larger availability attacks.
• Blast radius: Any deployment running Flowise < 3.1.3 with the Custom MCP node exposed to authenticated (even low-privileged) users is affected. The root working-directory bypass with node additionally suggests that containerized deployments may escape intended filesystem restrictions, widening the blast radius beyond the application directory.

The absence of an assigned CVSS vector and the single-source patch claim (2/4 confidence) mean that risk posture should be treated conservatively: until the patch is independently verified, all pre-3.1.3 instances should be considered vulnerable.

Detection Guidance

The following detection content targets the two observable behaviors of this vulnerability: (a) process creation events showing python3 or node spawned with PYTHONWARNINGS/BROWSER environment variables and shell metacharacters, and (b) HTTP requests to Flowise carrying MCP configuration payloads with these variables. Rules assume visibility into process creation and environment capture on the Flowise host; adapt field names to your data schema.

Sigma Rule

title: Flowise Custom MCP Environment Variable Abuse - CVE-2026-73601
id: e4d9f4a1-7c1e-4f3a-9b2d-6a1c9e8f7d3b
status: experimental
description: Detects python3 or node processes spawned with PYTHONWARNINGS/BROWSER environment variables containing shell metacharacters, consistent with CVE-2026-73601 exploitation of the Flowise Custom MCP node.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73601
logsource:
    category: process_creation
    product: linux
detection:
    selection_proc:
        Image|endswith:
            - '/python3'
            - '/node'
    selection_env:
        CommandLine|contains|all:
            - 'PYTHONWARNINGS'
        CommandLine|contains:
            - ';'
            - '&&'
            - '|'
            - '`'
            - '$('
    selection_browser:
        CommandLine|contains|all:
            - 'BROWSER='
        CommandLine|contains:
            - ';'
            - '&&'
            - '|'
    condition: selection_proc and (selection_env or selection_browser)
    level: high
falsepositives:
    - Legitimate MCP servers that intentionally use custom environment variables.
    - Development environments using PYTHONWARNINGS for warning suppression.
tags:
    - attack.t1210
    - cve.2026.73601
    - cwe.95

YARA Rule

rule Flowise_Custom_MCP_EnvAbuse_CVE_2026_73601
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Flowise Custom MCP stdio configuration payloads abusing PYTHONWARNINGS/BROWSER environment variables or root working directory for code injection (CVE-2026-73601)."
        cve = "2026-73601"
        cwe = "95"
        date = "2026-02-01"
    strings:
        $mcp_proto = "CUSTOM_MCP_PROTOCOL" ascii
        $mcp_stdio = "stdio" ascii
        $env_pw = "PYTHONWARNINGS" ascii
        $env_br = "BROWSER" ascii
        $proc_py = "python3" ascii
        $proc_node = "node" ascii
        $cwd_root = "\"cwd\": \"/\"" ascii
        $metachar1 = "&&" ascii
        $metachar2 = ";" ascii
        $metachar3 = "$(" ascii
    condition:
        $mcp_proto and $mcp_stdio and
        (
            (any of ($env_pw, $env_br) and any of ($proc_py, $proc_node)) or
            ($proc_node and $cwd_root)
        ) and
        any of ($metachar1, $metachar2, $metachar3) and
        filesize < 2MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Flowise Custom MCP stdio Env Var Code Injection Attempt (CVE-2026-73601)"; flow:established,to_server; content:"CUSTOM_MCP_PROTOCOL"; nocase; http_request_body; content:"stdio"; nocase; http_request_body; distance:0; content:"PYTHONWARNINGS"; nocase; http_request_body; distance:0; content:"python3"; nocase; http_request_body; distance:0; pcre:"/(?:;|\&\&|\||\`|\$\().{0,256}/i"; classtype:attempted-user; sid:202673601; rev:1;)

alert http any any -> any any (msg:"ET EXPLOIT Flowise Custom MCP node cwd Root Bypass Attempt (CVE-2026-73601)"; flow:established,to_server; content:"CUSTOM_MCP_PROTOCOL"; nocase; http_request_body; content:"stdio"; nocase; http_request_body; distance:0; content:"node"; nocase; http_request_body; distance:0; content:"\"cwd\": \"/\""; nocase; http_request_body; distance:0; classtype:attempted-user; sid:202673602; rev:1;)

Elastic Detection

sequence by host.id, user.id with maxspan=15s
  [ process where event.type == "start" and
      process.name in ("python3", "node") and
      process.args like ("*PYTHONWARNINGS*", "*BROWSER*", "cwd=/*") and
      process.args like ("*;*", "*&&*", "*|*", "*`*", "*$( *") ]
  [ process where event.type == "start" and
      process.parent.name in ("python3", "node") and
      process.executable like ("*/sh", "*/bash", "*/curl", "*/wget", "*/nc*") ]

Splunk SPL Query

index=* (sourcetype=ProcessRollup2 OR sourcetype=auditd OR sourcetype=linux_audit)
  (CommandLine=*PYTHONWARNINGS* OR CommandLine=*BROWSER=* OR CommandLine=*cwd=/*)
  AND (CommandLine=*python3* OR CommandLine=*node*)
  AND (CommandLine=*;& CommandLine=*&&* OR CommandLine=*|* OR CommandLine=*`* OR CommandLine=*$(*)
  OR (CommandLine=*node* AND CommandLine=*cwd=/*)
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, CommandLine, ParentCommandLine
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="flowise,cve_2026_73601,attack_execution,">
    <rule id="100736" level="12">
        <if_sid>5710</if_sid>
        <regex>PYTHONWARNINGS|BROWSER</regex>
        <regex>python3|node</regex>
        <regex>;\s|&amp;&amp;|\||`</regex>
        <description>Flowise CVE-2026-73601: suspicious environment variable and shell metacharacter usage in spawned python3/node process</description>
        <mitre>
            <id>T1210</id>
        </mitre>
        <group>flowise_rce</group>
    </rule>

    <rule id="100737" level="12">
        <if_sid>5710</if_sid>
        <regex>node</regex>
        <regex>cwd=\/|--cwd=\/</regex>
        <description>Flowise CVE-2026-73601: node process launched with root working directory, indicators of validation bypass</description>
        <mitre>
            <id>T1210</id>
        </mitre>
        <group>flowise_rce</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED) — OSV lists a fix in Flowise 3.1.3, but this is a single-source claim not independently confirmed by a vendor advisory. Until confirmed, treat all versions as potentially vulnerable.

Immediate mitigations (days):

• If the Custom MCP node is not essential to your flows, disable it entirely or restrict its configuration to administrative users only.
• If feasible, disallow the CUSTOM_MCP_PROTOCOL value of stdio for non-admin accounts; force MCP connectivity over HTTP/SSE where supported, which does not involve local process spawning.
• Place the Flowise instance behind an authentication proxy and enforce least-privilege access so that only vetted users can create or modify flows. Revoke accounts of former employees and audit user lists for unauthorized entries.
• Deploy network egress controls on the Flowise host to block outbound reverse-shell / exfiltration traffic (e.g., block outbound SSH, non-allowlisted HTTP/S, and raw TCP to suspicious destinations).
• Monitor the host for the process-creation patterns described in the Detection Guidance section.

Patch / upgrade steps (weeks):

• Upgrade to Flowise 3.1.3 or later as soon as the release is independently verified. Back up flow definitions and the application database before upgrading.
• After upgrading, re-test Custom MCP node configurations, especially any that use python3, node, or custom environment variables, to confirm sanitization is applied.
• If 3.1.3 cannot be verified or deployed, consider forking/pinning the vulnerable component and applying a manual input-validation patch on the process-spawn parameters (command, arguments, environment variables, working directory) while awaiting an official advisory.
• Re-check OSV and NVD weekly for confirmation of the patch or for an updated fixed version.

Long-term hardening (months):

• Run Flowise in a container or sandbox with a read-only root filesystem, no host mount exposure, and a non-root user with minimal capabilities. This limits the damage from arbitrary command execution.
• Inject secrets (LLM API keys, database credentials) via a secrets manager and runtime environment at the orchestrator level, never store them in flow definitions or the Flowise database where a compromised node can read them.
• Establish a routine for scanning Flowise releases for new CVEs and subscribe to the project's security advisories. Perform periodic penetration tests of the flow-editor functionality, focusing on injection points in node configuration fields.
• Segment Flowise hosts from the internal corporate network so that a compromise does not immediately yield lateral movement paths.

References

1. NVD Entry — CVE-2026-73601: https://nvd.nist.gov/vuln/detail/CVE-2026-73601
2. OSV Advisory — CVE-2026-73601 (single-source patch claim): https://osv.dev/vulnerability/CVE-2026-73601
3. Flowise Official Project (vendor repository): https://github.com/FlowiseAI/Flowise
4. CWE-95 — Improper Neutralization of Directives in Dynamically Evaluated Code: https://cwe.mitre.org/data/definitions/95.html
5. EPSS Data for CVE-2026-73601: https://www.first.org/epss/api (search by CVE)

Threat actor / in-the-wild evidence: None known at the time of writing. CISA KEV status: NO. No public PoC, Nuclei template, or exploit code has been identified. The EPSS score of 0.00606 (46.1% percentile) suggests the vulnerability is within active scanning consideration, but no confirmed exploitation campaigns have been reported.