CVE-2026-91931

Flowise before 3.1.4 Remote Code Execution via Custom MCP npx

No known exploitation. EPSS puts it in the 50th percentile. No fix published yet.

CVSS 3.18.5High EPSS percentile50th0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-15Updated 2026-09-23Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you run Flowise and whether its version is earlier than 3.1.4.
Upgrade Flowise to version 3.1.4.
Until upgraded, disable Custom MCP access or limit it to fully trusted administrators.
Review recent server activity for unexpected npx commands or unfamiliar package installations.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code on the Flowise server.

In plain language

Written by AI from the record

Flowise versions before 3.1.4 let a logged-in user run harmful software on the server, so businesses using Flowise should upgrade.

Authenticated RCE in Flowise Custom MCP through attacker-controlled npx package names in mcpServerConfig, enabling execution of arbitrary npm package code on the server.

If you're affected

Full server takeover
Business data exposure
Service disruption
Malware deployment
Ransomware risk

What is it

This is a flaw in a Flowise feature that can be used to add external tools. It is like allowing a staff member to order supplies for the office but letting them choose an unverified delivery person who can then enter the building and do anything they want.

Who is affected

This matters to you if you run Flowise, especially if administrators or other users can configure Custom MCP connections. An attacker must already have a valid Flowise login to use this issue.

How urgent is it

No known public attacks or public attack code have been reported, but a successful attacker with a login can take control of the Flowise server. Treat this as a near-term upgrade: restrict access to the affected feature and schedule the update promptly.

What to do — in detail

Confirm the deployed Flowise version and identify whether any Custom MCP node uses mcpServerConfig with npx package names. Upgrade every affected deployment to Flowise 3.1.4; no separate fixed branches are identified in the available findings. Review release notes and test the upgrade in a non-production environment first, as compatibility or breaking-change information is not yet known. If patching is delayed, disable Custom MCP nodes that invoke npx, or ensure only tightly controlled administrator accounts can edit their configuration. No CISA KEV remediation due date applies because this CVE is not listed in KEV. After remediation, investigate process and package-manager records for unexpected npx executions, unfamiliar npm packages, or suspicious server-side child processes.

Technical context

CVE-2026-91931 is CVSS 8.5 High (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) and maps to CWE-78. The attack requires low-privileged authentication but no user interaction; attacker-controlled npx package names in Custom MCP mcpServerConfig can cause arbitrary code execution through npm package execution. It is not listed in CISA KEV, no public exploit code is on record, and EPSS is 0.6% (49th percentile) with a flat trend. Press attention is new, but that does not establish active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS50th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 50th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 8 days, from the signal feeds we watch.

2026-09-23Record updated
2026-09-17Record updated
2026-09-16OpenVAS check added
2026-09-15Publishedweakness classified, att&ck mapped, record updated

Affected products

FlowiseAIoss-projectaka flowise-components, embed, flowise
- FlowiseWeb AppOn-premAI / ML / ai-agent-tooling

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Scored 8.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable