CVE-2026-91932

Executive Summary

CVE-2026-91932 is a validation bypass vulnerability (CWE-20, Improper Input Validation) in the Flowise low-code LLM/agent orchestration platform affecting versions before 3.1.4. An authenticated attacker can manipulate the MCP (Model Context Protocol) server configuration—specifically the working-directory (cwd) parameter—to bypass path validation and achieve remote code execution (RCE). The flaw is rated CVSS 8.5 (High) with a scope change and full confidentiality, integrity, and availability impact, making it a serious risk for any internet-exposed or multi-tenant Flowise deployment.

Technical Analysis

Flowise is a self-hostable, low-code platform for building LLM applications, chatflows, and autonomous agents. To extend agent capabilities, Flowise supports integration with MCP (Model Context Protocol) servers, which are launched as subprocesses and communicate with the Flowise runtime. An MCP server entry includes a command, an args array, and an optional working directory (cwd).

CVE-2026-91932 is a classic improper-input-validation (CWE-20) flaw. Per the NVD description, the application fails to validate the cwd parameter. The defense the developers (or downstream operators) rely on is path validation applied to filenames in the args array — attackers can supply "clean" filenames there to pass validation, while simultaneously controlling the cwd to a location that contains a malicious executable/payload. Because the subprocess is spawned with the attacker-chosen working directory, a relative command/argument resolves against an attacker-controlled path rather than a trusted one, allowing code of the attacker's choosing to run.

The "validation bypass" nature means that whatever path-confinement logic exists (e.g., verifying that referenced files live inside an allowed directory) is anchored to the wrong element: it inspects args but not cwd. This is a "validate-one-field-while-another-controls-the-outcome" pattern, common in subprocess-spawning features. The exact internal function names and validation routines are not disclosed in the available description and are therefore not asserted here.

Key CVSS attributes supporting the High rating:

• AV:N — exploitable over the network (Flowise is web-facing).
• AC:H — some conditions must align (attacker must control both args filenames and cwd; requires ability to place a malicious file at the controlled path).
• PR:L — attacker must be authenticated to reach MCP server configuration.
• S:C — scope change: the compromised MCP subprocess runs outside the security boundary of the Flowise application, so the vulnerable component and the impacted component differ.
• C:H/I:H/A:H — full loss of confidentiality, integrity, and availability on the host.

Authentication is required (PR:L), which reduces the ease of exploitation but does not eliminate it — Flowise instances with weak, default, or shared credentials, or with self-registration enabled, dramatically lower the bar. The scope change (S:C) is the most operationally significant factor: successful exploitation typically means arbitrary command execution as the Flowise service account, which in containerized deployments often maps to a privileged context or one with access to mounted secrets.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for this CVE. The following attack chain is inferred strictly from the vulnerability class (improper validation of a subprocess working-directory parameter) and the details in the NVD description. No specific function names, endpoints, or parameters beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies a reachable Flowise instance (version < 3.1.4), for example via Shodan fingerprinting using the dorks above, or by encountering it during normal web application enumeration. The attacker confirms it is a Flowise deployment and determines whether authentication is required and whether credentials can be obtained (default credentials, self-registration, or a compromised low-privilege account).

2. Authentication and access to MCP configuration. With a valid account, the attacker navigates to the MCP server configuration feature. Because the flaw lives in configuration handling, no exploit payload is needed to reach the vulnerable surface—only the ability to create or edit an MCP server entry.

3. Triggering the validation bypass. The attacker crafts an MCP server definition in which the args array references a benign-looking ("clean") filename that satisfies the application's path validation, while the cwd parameter is set to a directory the attacker controls (or one writable by the Flowise account). The validation logic inspects args but not cwd, so the malicious working directory passes unchallenged.

4. Execution and post-exploitation. When the MCP server is instantiated/launched, the subprocess executes with the attacker-controlled working directory. A relative reference then resolves to attacker-supplied code, resulting in remote code execution. From there the attacker can read environment variables and mounted secrets, exfiltrate data, pivot to connected services and LLM API keys, establish persistence, or disrupt availability — consistent with the CVSS scope change and full CIA impact.

Prerequisites: authenticated access (PR:L), a writable/controllable directory path for cwd, and the ability to place the referenced file there (which may be achievable through other file-write primitives in the platform). AC:H reflects these alignment requirements.

Impact Assessment

• Business impact: RCE on a Flowise host exposes LLM/agent orchestration credentials, API keys, connected vector databases, and any secrets mounted into the environment. Because Flowise orchestrates agents with access to external tools and data, compromise can cascade into downstream systems and data stores.
• Affected systems: All Flowise deployments before 3.1.4 that expose the MCP server configuration feature to authenticated users. Multi-tenant or internet-facing instances are highest risk.
• Blast radius / scope: The CVSS scope change (S:C) means impact extends beyond the Flowise application itself to the underlying host and its network context. A containerized deployment limits blast radius only if the container is unprivileged and lacks host mounts and lateral reachability.
• CVSS subscores referenced: AV:N, AC:H, PR:L, UI:N, S:C, C:H/I:H/A:H = 8.5 High. No EPSS score is available (not yet scored by FIRST.org); CVE is NOT in CISA KEV; no known exploitation in the wild.

Detection Guidance

Sigma Rule

title: Flowise MCP Server Working Directory Validation Bypass (CVE-2026-91932)
id: 8f2a5c1e-9b7d-4e3a-a1c6-b2d4e5f6a7b8
status: experimental
description: Detects creation/modification of MCP server configuration with a suspicious cwd parameter in Flowise prior to 3.1.4
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91932
author: valtersit.com
date: 2026/01/01
logsource:
  product: flowise
  category: application
detection:
  selection_action:
    event_type|contains:
      - 'mcp'
      - 'MCPServer'
  selection_cwd:
    request_body|contains: 'cwd'
  selection_suspicious_path:
    request_body|contains:
      - '/tmp'
      - '/var/tmp'
      - '/dev/shm'
      - '../../'
      - '..\\..\\'
  condition: selection_action and selection_cwd and selection_suspicious_path
falsepositives:
  - Legitimate administrative configuration using non-standard working directories
level: high
tags:
  - attack.t1190
  - cve.2026.91932

YARA Rule

rule CVE_2026_91932_Flowise_MCP_CWD_Bypass
{
    meta:
        description = "Detects MCP server config payloads abusing unvalidated cwd in Flowise < 3.1.4"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91932"
        author = "valtersit.com"
        date = "2026-01-01"
        cve = "CVE-2026-91932"

    strings:
        $a = "cwd" ascii wide nocase
        $b = "mcpServers" ascii wide nocase
        $c = "args" ascii wide nocase
        $d1 = "/tmp" ascii
        $d2 = "/var/tmp" ascii
        $d3 = "/dev/shm" ascii
        $e1 = "../../" ascii
        $e2 = "..\\..\\" ascii

    condition:
        uint16(0) != 0x5A4D and
        $a and ($b or $c) and 1 of ($d*) and 1 of ($e*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91932 Flowise MCP cwd Validation Bypass Attempt"; flow:to_server,established; http.method; content:"POST"; http.request_body; content:"cwd"; nocase; content:"mcpServers"; nocase; pcre:"/(\/tmp\/|\/dev\/shm\/|\/var\/tmp\/|\.\.\/\.\.\/)/i"; reference:cve,2026-91932; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91932; classtype:attempted-admin; sid:202691932; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name with maxspan=1m
  [any where event.action == "mcp_server_config_access"]
  [any where event.action in ("mcp_server_create", "mcp_server_update")
       and process.args : "*cwd*"
       and wildcard(process.args, "*../*", "*/tmp/*", "*/dev/shm/*", "*/var/tmp/*")]

Splunk SPL Query

index=flowise sourcetype=flowise:app (uri_path="*mcp*" OR message="*mcpServer*")
| search ("cwd" AND ("/tmp" OR "/var/tmp" OR "/dev/shm" OR "../" OR "..\\"))
| eval risk="CVE-2026-91932 cwd validation bypass RCE attempt"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ips values(user) as users by uri_path, risk
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="flowise,cve-2026-91932,">
  <rule id="2026919" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">mcp_server_config</field>
    <regex type="pcre2">cwd.*(\/tmp\/|\/var\/tmp\/|\/dev\/shm\/|\.\.\/\.\.\/)</regex>
    <description>CVE-2026-91932: Flowise MCP server cwd validation bypass attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,rce,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

• OSV is the sole source indicating the patch; independent confirmation is pending.

1. Immediate mitigations

   • Restrict authenticated access: disable self-registration, rotate default/weak credentials, and enforce strong authentication and MFA where available.
   • Lock down the MCP server configuration feature to a trusted administrator role only; remove it from lower-privileged accounts.
   • Network-restrict the Flowise management interface so it is not internet-exposed; place it behind an authenticated reverse proxy or VPN.
   • Run Flowise in an unprivileged container with read-only root filesystem, no host mounts, and no writable /tmp,/var/tmp, /dev/shm outside a sandbox, to limit cwd-based execution paths.

2. Patch / upgrade steps

   • Upgrade Flowise to 3.1.4 or later, which the OSV source claims resolves the unvalidated cwd issue. Because patch confidence is only CLAIMED (2/4), verify the fix against the vendor changelog or a controlled test before relying on it, and confirm the exact fixed version.
   • After upgrading, re-audit existing MCP server definitions for unexpected cwd values.

3. Long-term hardening

   • Apply allow-list validation to the entire MCP server subprocess definition (command, args, and cwd), not just filenames in args.
   • Spawn MCP subprocesses in a sandbox/seccomp/least-privilege context with a fixed, read-only working directory.
   • Monitor for anomalous MCP config changes and subprocess spawns; alert on cwd referencing world-writable directories or .. traversal.
   • Track the CVE for EPSS and KEV updates and reassess priority if exploitation emerges.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91932
• OSV: https://osv.dev/ (single source claiming patch)
• Flowise project/documentation: (consult vendor release/changelog for 3.1.4)
• MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
• CWE-20 (Improper Input Validation): https://cwe.mitre.org/data/definitions/20.html

Exploitation status: No public PoC, exploit code, or Nuclei template exists; CVE is NOT in CISA KEV; EPSS not yet scored. No known threat actor campaigns or exploit-in-the-wild evidence at time of writing.