Exploit Code Published for Critical Flowise RCE Vulnerability
A critical remote code execution (RCE) vulnerability, CVE-2026-40933, has been discovered in Flowise, a popular open-source AI agent platform. The flaw, stemming from a command injection issue within the Anthropic MCP protocol, allows attackers to execute arbitrary code on vulnerable systems. This poses a significant risk to organizations utilizing Flowise, particularly those with self-hosted instances, due to the potential for data compromise and system takeover.
The vulnerability, tracked as CVE-2026-40933 with a CVSS score of 9.9, was initially disclosed in April and affects Flowise versions prior to 3.1.0. Obsidian Security identified the root cause as a ‘by design’ command injection vulnerability within the Anthropic MCP protocol, which propagates through systems utilizing it. The flaw allows an attacker to inject malicious commands into Flowise flows, leading to code execution on the underlying operating system. Obsidian Security has released proof-of-concept code demonstrating how a crafted chatflow can be imported to achieve this, effectively gaining control of the server. The impact is amplified by the potential for accessing credentials, connected services, and integration points within the Flowise environment, particularly in containerized deployments where privileges can be elevated to root.