CVE-2025-8943: Flowise Custom MCPs feature allows unauthenticated OS command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable OS command execution with a CVSS of 9.8 and high EPSS, though no confirmed in-the-wild exploitation is documented.

What it is

Flowise's Custom MCPs feature is meant to run OS commands such as npx to start local MCP servers, but the platform's authentication and authorization model is minimal and lacks role-based access controls. In versions before 3.0.1, a default installation runs without authentication unless explicitly configured, so the command execution path is reachable without credentials. The result is unauthenticated remote code execution on the host running Flowise.

Impact

An attacker gains unsandboxed OS command execution on the Flowise host, leading to full compromise of confidentiality, integrity and availability of that system and anything reachable from it.

Attack surface

Reachable over the network via the Custom MCPs feature; the CVSS vector is AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. The description confirms default pre-3.0.1 installs have no authentication unless configured.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is 0.663 (99.2nd percentile) and the sole reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade Flowise to 3.0.1 or later, which removes the unauthenticated default behavior.
• If upgrade is not immediately possible, enable authentication explicitly and restrict network access to the Flowise instance to trusted hosts only.
• Disable or remove the Custom MCPs feature where it is not required, since it is designed to execute OS commands.
• Run Flowise under a low-privilege service account with no access to sensitive files or credentials, and isolate it from internal networks.
• Monitor for unexpected child processes such as npx or shell commands spawned by the Flowise process.

Detection

• Alert on Flowise process spawning shells or commands like npx, node, sh or bash, especially outside expected startup windows.
• Review Flowise access logs for unauthenticated requests to MCP or custom tool endpoints from unexpected source IPs.
• Baseline and monitor outbound connections from the Flowise host for command-and-control or download activity following MCP requests.
• Audit Flowise configuration to confirm authentication is enabled and identify instances still running pre-3.0.1 defaults.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.