Flowise: Parameter Override Bypass Remote Command Execution

### Summary Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the `FILE-STORAGE::` keyword combined with a `NODE_OPTIONS` environment variable injection. This allows for the execution of arbitrary system commands with root privileges within the containerized Flowise instance, requiring only a single HTTP request and no authentication or knowledge of the instance. ### Details The vulnerability is in a validation check within the `replaceInputsWithConfig` function within `packages/server/src/utils/index.ts`. The check for `FILE-STORAGE::` was intended to handle file-type inputs but has three issues: 1. Uses .includes() instead of .startsWith(): The check passes if FILE-STORAGE:: appears ANYWHERE in the string, not just at the beginning. A remote user can embed it in a comment: /* FILE-STORAGE:: */ { custom config } 2. No parameter type validation: The check doesn't verify that the parameter is actually a file-type input. It applies to ANY parameter name, including mcpServerConfig. 3. Complete bypass, not partial: When the check passes, it skips the isParameterEnabled() call entirely, allowing modification of parameters that administrators never authorized. **Vulnerable Code (`FILE-STORAGE::` bypass):** ```typescript // packages/server/src/utils/index.ts, line 1192-1198 // Skip if it is an override "files" input, such as pdfFile, txtFile, etc if (typeof overrideConfig[config] === 'string' && overrideConfig[config].includes('FILE-STORAGE::')) { // pass <-- BYPASSES ALL VALIDATION } else if (!isParameterEnabled(flowNodeData.label, config)) { // Only proceed if the parameter is enabled continue } ``` This bypass allows an attacker to override the `mcpServerConfig` and inject a malicious `NODE_OPTIONS` value. The `Custom MCP` node's environment variable blocklist does not include `NODE_OPTIONS`, enabling an attacker to use the `--experimental-loader` to execute arbitrary JavaScript code before the main process starts. **Vulnerable Code (`NODE_OPTIONS` not blocked):** ```typescript // packages/components/nodes/tools/MCP/core.ts, line 248-254 const dangerousEnvVars = ['PATH', 'LD_LIBRARY_PATH', 'DYLD_LIBRARY_PATH'] for (const [key, value] of Object.entries(env)) { if (dangerousEnvVars.includes(key)) { throw new Error(`Environment variable '${key}' modification is not allowed`) } } ``` ### Requirements **API Override Enabled** The chatflow must have "API Override" toggled ON in Chatflow Configuration. **Public Chatflow** The chatflow must be shared publicly. **MCP Node** The chatflow must contain a MCP tool node (Custom MCP tool was tested and confirmed). Although not enabled by default, the API Override feature is a powerful and officially documented capability that may be used in production deployments. Its primary purpose is to make chatflows dynamic and user-aware. Common use cases that necessitate enabling this feature include: * **Session Management:** Passing a unique `sessionId` or `chatId` for each user to maintain separate conversation histories. * **User-Specific Variables:** Injecting user data such as name, preferences, or role into prompts to create personalized experiences. * **Dynamic Tool Selection:** Allowing users to specify which data sources or APIs to query based on their needs. * **Multi-Tenant Applications:** Supporting different configurations for each customer or organization without deploying separate chatflows. * **A/B Testing:** Evaluating different prompts or models in a live environment. ### Setup To reproduce the vulnerability, follow these steps: **Step 1: Start Flowise Instance** ```bash docker run -d --name flowise-test -p 3000:3000 flowiseai/flowise:latest ``` **Step 2: Configure a Public Chatflow with MCP Tool** 1. Navigate to `http://localhost:3000` and create an account. 2. Create a new chatflow. 3. Add a `Custom MCP` node and a `Cu

CVSS 3.0

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Severity from

GitHub (reviewed advisory)

Weakness

CWE-20

Also known as

CVE-2026-41268

• github.com/FlowiseAI/Flowise/security/advisories/GHSA-cvrr-qhgw-2mm6
• nvd.nist.gov/vuln/detail/CVE-2026-41268
• github.com/FlowiseAI/Flowise