Active Exploitation of Flowise CustomMCP RCE Exposes Thousands of Internet-Facing Instances
Threat actors are actively exploiting CVE-2025-59528, a CVSS 10.0 remote code execution flaw in the open-source AI platform Flowise. The bug affects Flowise versions through 3.0.5 and stems from the CustomMCP node unsafely passing user-controlled input into JavaScript execution, allowing attackers with an API token to run arbitrary code with full Node.js runtime privileges. Researchers said the issue can be triggered remotely via a crafted HTTP POST request without user interaction, leading to operating system command execution, filesystem access, sensitive data theft, and full system compromise.
Security researchers observed in-the-wild exploitation originating from a single Starlink IP address, while warning that roughly 12,000 to 15,000 internet-exposed Flowise instances sharply expand the attack surface for opportunistic attacks. Flowise disclosed the vulnerability in 2025, credited researcher Kim SooHyun, and patched the flaw in version 3.0.6. The incident marks the third Flowise vulnerability reported as exploited in the wild after CVE-2025-8943 and CVE-2025-26319, increasing pressure on organizations to upgrade immediately and limit public exposure of Flowise APIs.
Timeline
Apr 20, 2026
OX Security discloses broader MCP design flaw impacting Flowise and AI tools
OX Security disclosed a critical remote command execution exposure tied to architectural flaws in Anthropic's MCP SDKs, affecting Flowise and multiple other AI frameworks rather than a single-product bug. The researchers reported successful command execution on six production platforms, identified several exploitation families, and said at least ten CVEs had been issued across affected products.
Apr 8, 2026
VulnCheck flags two more Flowise flaws under active exploitation
VulnCheck reported that two additional critical Flowise vulnerabilities, CVE-2025-8943 and CVE-2025-26319, were also being actively exploited. The company said it was providing customers with exploitation data and defensive artifacts including a PCAP, YARA rule, network signatures, and a target Docker container.
Apr 7, 2026
Researchers warn 12,000-15,000 internet-exposed Flowise instances are at risk
Security reporting highlighted that roughly 12,000 to 15,000 Flowise instances were exposed to the public internet, increasing the likelihood of opportunistic attacks. The exposure amplified the impact of the actively exploited RCE flaw.
Apr 1, 2026
VulnCheck observes in-the-wild exploitation of CVE-2025-59528
In April 2026, VulnCheck reported active exploitation of CVE-2025-59528 against Flowise instances. The observed activity was initially traced to a single Starlink IP address.
Sep 1, 2025
Flowise fixes CVE-2025-59528 in version 3.0.6
Flowise released a fix for CVE-2025-59528 in npm package version 3.0.6. The vulnerability affects versions up to 3.0.5 and can enable remote code execution through unsafe execution of user-supplied JavaScript.
Sep 1, 2025
Flowise discloses CVE-2025-59528 and credits researcher Kim SooHyun
Flowise disclosed CVE-2025-59528, a maximum-severity code injection flaw in the CustomMCP node, in September 2025. The issue was credited to researcher Kim SooHyun.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Vulnerabilities
Organizations
Sources
5 more from sources like cyber security news, the hacker news, bleeping computer, cyberthrone and github advisories github link
Related Stories
Critical Flowise RCE Vulnerability CVE-2025-61913 Enables Arbitrary File Read and Write
A critical remote code execution vulnerability, tracked as CVE-2025-61913, has been identified in Flowise, a drag-and-drop user interface for building customized large language model flows. The flaw exists in versions prior to 3.0.8 and is caused by insufficient restrictions in the WriteFileTool and ReadFileTool components, which fail to properly validate file path access. This oversight allows authenticated attackers to read and write arbitrary files to any location on the file system, significantly increasing the risk of remote code execution. The vulnerability has been assigned a CVSS score of 10.0, indicating its maximum severity and potential for exploitation. According to security advisories, the issue can be exploited remotely, making it a high-priority concern for organizations using affected versions of Flowise. The vulnerability was publicly disclosed on October 8, 2025, and a security update was released in version 3.0.8 to address the issue. Attackers leveraging this flaw could gain unauthorized access to sensitive files, modify system configurations, or deploy malicious payloads, potentially leading to full system compromise. The vulnerability affects all installations of Flowise prior to the patched version, though the exact list of affected products and vendors has not been fully enumerated. Security researchers emphasize the critical nature of the flaw due to the ease of exploitation and the broad impact on confidentiality, integrity, and availability. Organizations are strongly advised to upgrade to Flowise version 3.0.8 or later to mitigate the risk. The vulnerability was reported through GitHub security advisories, highlighting the importance of monitoring open-source project disclosures. No evidence of active exploitation in the wild has been reported as of the disclosure date, but the public availability of technical details increases the urgency for remediation. The flaw underscores the risks associated with insufficient input validation in file handling components of web applications. Security teams should review their deployment of Flowise and apply the necessary patches without delay. In addition to patching, organizations should audit access logs for signs of suspicious file operations that could indicate attempted exploitation. The incident serves as a reminder of the critical need for secure coding practices and regular vulnerability assessments in software development.
1 months ago
Flowise fixes multiple flaws enabling RCE, tenant abuse, and API credit theft
Flowise disclosed and fixed a cluster of high-severity vulnerabilities in versions prior to **3.1.0**, including multiple paths to remote code execution. The most serious issues affect the platform's CSV and Airtable agent components, where unsanitized user input or LLM-generated Python code could be evaluated without proper sandboxing. Advisories for **`CVE-2026-41137`**, **`CVE-2026-41264`**, **`CVE-2026-41138`**, and **`CVE-2026-41265`** describe authenticated and unauthenticated attack paths that let attackers inject malicious payloads through chatflows or agent inputs and execute code on the Flowise server, with potential impact to confidentiality, integrity, and availability. Flowise **3.1.0** also addresses non-RCE flaws that could expose multi-tenant environments and consume third-party service credits. **`CVE-2026-41279`** affects the unauthenticated text-to-speech endpoint at **`POST /api/v1/text-to-speech/generate`**, which could accept an arbitrary **`credentialId`** and use decrypted stored credentials such as OpenAI or ElevenLabs API keys to generate speech, enabling API credit abuse. In **Flowise Cloud**, **`CVE-2026-41267`** allows improper mass assignment during account registration, letting unauthenticated attackers inject server-managed fields and manipulate organization associations, ownership metadata, timestamps, and role mappings across tenants. Organizations running Flowise or Flowise Cloud should upgrade to **3.1.0** and review exposed chatflows, stored credentials, and tenant registration controls.
Yesterday
Critical Langflow RCE in Public Flow Endpoint Exploited Immediately
A critical **unauthenticated remote code execution** flaw in Langflow, tracked as `CVE-2026-33017`, allows attackers to execute arbitrary Python code through the `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint. The vulnerability affects Langflow versions prior to `1.9.0` and stems from the application's handling of the optional `data` parameter, which can carry attacker-controlled flow definitions that are passed to `exec()` without sandboxing. The issue is separate from the earlier `CVE-2025-3248`, which involved authentication on a different endpoint. Security researchers reported exploitation beginning within 20 hours of public disclosure, with attackers scanning for exposed Langflow instances, stealing credentials and environment data, reading files including `/etc/passwd`, and attempting to fetch a follow-on payload from `173.212.205[.]251:8443`. The flaw requires no privileges or user interaction and carries high impact across confidentiality, integrity, and availability, underscoring the risk to AI workflow platforms that often hold sensitive data and integration secrets.
1 months ago