CVE-2026-56274 -- CVSS 9.9 Vulnerability Briefing

CVE-2026-56274 | CVSS 9.9 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-56274 is a set of OS command injection vulnerabilities in Flowiseai Flowise, specifically within the Custom MCP Server feature, affecting all versions prior to 3.1.2.

Technical Detail

The flaws stem from incomplete command-flag validation and a bypassable regex used to restrict local file access within the Custom MCP Server component. An attacker who can interact with this feature can craft malicious input that circumvents the validation logic, injecting arbitrary OS commands that execute in the context of the underlying server process. Successful exploitation results in unauthenticated or low-privilege remote code execution, with a CVSS score of 9.9 reflecting the near-complete impact on confidentiality, integrity, and availability of the host system.

Exploitation Status

No known exploit code has been publicly observed or confirmed as of June 30, 2026. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit at this time, though the high severity and straightforward injection class make this a candidate for rapid weaponization once details circulate.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability in available intelligence sources.

What To Do

Upgrade Flowise to version 3.1.2 or later immediately. Given the critical CVSS score and the nature of OS command injection, this should be treated as a high-priority patch. If immediate patching is not feasible, restrict network access to the Flowise instance, particularly the Custom MCP Server feature, to trusted internal hosts only, and disable the feature if it is not operationally required. Monitor host-level process execution logs for anomalous child processes spawned by the Flowise service, as this would be a primary detection signal for exploitation attempts. Review any Flowise deployments exposed to the internet or accessible to untrusted users as the highest-risk instances.