What happened
Flowise, a popular low-code LLM/agent application builder, had three chained configuration-validation gaps in its MCP-server integration and chat-model nodes that let any authenticated user achieve remote code execution or exfiltrate LLM provider credentials via SSRF to metadata endpoints.
Why it matters
Flowise is widely used to visually assemble LLM agent workflows; because MCP server configuration and model endpoints are attacker-reachable by any authenticated low-privilege user, these bugs let a single compromised or malicious low-trust account pivot to full host RCE or steal the API keys backing every LLM provider connected to the instance.
Attack vector
Three related flaws in Flowise before 3.1.4: (1) the Custom MCP node's mcpServerConfig parameter lets an authenticated attacker specify arbitrary npx package names, which are then executed (CVE-2026-91931); (2) an unvalidated cwd parameter lets an attacker bypass path validation using clean filenames in the args array while controlling the working directory, also yielding RCE (CVE-2026-91932); (3) chat-model nodes fail to validate baseURL, letting an attacker with chatflows:create/update permission redirect LLM provider requests to attacker-controlled hosts or cloud metadata services to exfiltrate API keys (CVE-2026-91935).
Affected systems
FlowiseAI Flowise prior to 3.1.4
Mitigation
Upgrade Flowise to 3.1.4 or later. Restrict who can create/edit chatflows and MCP node configurations, since all three issues require only authenticated (not necessarily admin) access.