{"vulnerability": "cve-2026-56274", "sightings": [{"uuid": "f6fd408c-a0ea-4383-b928-2572362211f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56274", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moxmasquup2a", "content": "CVE-2026-56274 - Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess\nCVE ID : CVE-2026-56274\n \n Published : 23 juin 2026 12:13 | 1\u00a0heure, 30\u00a0minutes ago\n \n Description : Flowise before 3.1.2 contains multiple OS co...", "creation_timestamp": "2026-06-23T14:27:06.959345Z"}, {"uuid": "35a2507a-0993-4f14-91e6-47df3bbe3445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-56274", "type": "seen", "source": "https://gist.github.com/muhamedfazalps/db2c0e46436e75ee35dd214e14e27b40", "content": "# CVE-2026-56274: Critical OS Command Injection in Flowise\n\n**CVSS 9.9 (Critical) | Disclosed: June 24, 2026 | Unpatched**\n\n## Summary\nCVE-2026-56274 is an OS command injection vulnerability in FlowiseAI Flowise before version 3.1.2, specifically in the Custom MCP Server feature.\n\n## Technical Details\n- **CWE**: CWE-78 (OS Command Injection)\n- **CVSS Vector**: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n- **Attack Type**: Remote (network)\n- **Privileges Required**: Low (any authenticated user)\n- **Impact**: Complete compromise of confidentiality, integrity, and availability\n\nThe vulnerability consists of two bypasses:\n1. Incomplete command-flag validation (e.g., `docker build` not blocked, `npx --yes` not blocked)\n2. Regex bypass in local file access restrictions\n\n## Affected\n- FlowiseAI Flowise < 3.1.2\n- Note: Flowise was acquired by Workday (NASDAQ: WDAY) in August 2025\n\n## Mitigation\n- Disable Custom MCP Server feature\n- Restrict API access\n- Monitor for unusual child processes\n- Network segmentation\n\n## References\n- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56274\n- Full Article: https://muhamedfazalps.github.io/security-alerts-june-2026/blog/cve-2026-56274-flowise-rce.html\n\n---\n*If this analysis helped you, consider supporting security research: https://buymeacoffee.com/muhamedfazalps*", "creation_timestamp": "2026-06-25T05:40:10.554880Z"}, {"uuid": "97d9f883-fce1-427e-bd1e-1a54d2d207c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56274", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqc2ojfhn72n", "content": "\ud83d\udccc CVE-2026-56274 - Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation... https://www.cyberhub.blog/cves/CVE-2026-56274", "creation_timestamp": "2026-07-10T11:37:06.590194Z"}, {"uuid": "c8172e7e-c99d-4e8c-bac8-a15eb54360c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56274", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/flowise_mcp_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"cn-panda\", \"ABDUL JAFAROV \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Flowise versions from 2.2.7 prior to 3.1.2 are vulnerable to remote code execution\\n          through the Custom MCP (Model Context Protocol) node configuration.\\n\\n          The vulnerability exists in the /api/v1/node-load-method/customMCP endpoint,\\n          which accepts arbitrary command and argument configurations for MCP server\\n          initialization. An authenticated attacker can abuse the npx --yes flag to\\n          fetch and execute a malicious npm package from an attacker-controlled HTTP\\n          server, achieving arbitrary command execution on the Flowise host.\\n\\n          This module creates a malicious npm package tar archive in memory, serves it\\n          via Metasploit's built-in HTTP server, then triggers the vulnerable endpoint\\n          to download and execute the package via npx.\\n\\n          To interact with the obtained shell, use the command: sessions -i \\n          (for example: sessions -i 1).\", \"disclosure_date\": \"2026-06-23\", \"fullname\": \"exploit/multi/http/flowise_mcp_rce\", \"is_install_path\": true, \"mod_time\": \"2026-08-20 18:02:33 +0000\", \"name\": \"Flowise MCP Server Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/flowise_mcp_rce.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/flowise_mcp_rce\", \"references\": [\"CVE-2026-56274\", \"CWE-78\", \"GHSA-GHSA-m99r-2hxc-cp3q\"], \"rport\": 3000, \"session_types\": false, \"targets\": [\"Unix Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-08-24T06:44:12.577697Z"}]}