CVE-2026-73601 is a command execution flaw (CWE-95) in the Custom MCP node of Flowise, reachable when the stdio protocol is enabled. The record rates it High at 8.8 and needs a login. Flowise 3.1.3 fixes it, so upgrade and review who can configure MCP servers in your instance.
What's affected
The record says Flowise versions before 3.1.3 are affected. The GitHub advisory (GHSA-g98q-rm45-q9h8) lists flowise-components at 3.1.2 and earlier, patched in 3.1.3. It was disclosed by elttam against 3.1.2.
The exposure depends on a setting. The advisory says deployments with CUSTOM_MCP_PROTOCOL set to stdio are affected, and that stdio is the default. An authenticated user can then configure a Custom MCP server that launches a local process.
Severity, as two sources state it. The record gives 8.8 under CVSS 3.1, which is High. VulnCheck lists it as critical at 9.0 under CVSS 4.0. Both agree that the attacker needs an account.
How to check if you're exposed
Look at the environment of your Flowise service for the CUSTOM_MCP_PROTOCOL variable.
env | grep CUSTOM_MCP_PROTOCOL
docker inspect <container> | grep CUSTOM_MCP_PROTOCOL
npm ls flowise-components
If the variable is unset, the advisory says stdio is the default, so assume stdio is on. Then list the users who can add or change Custom MCP nodes. Anyone with that right can start a process on the host, which is the capability the flaw makes dangerous.
What to do now
- Upgrade Flowise and
flowise-componentsto 3.1.3 or later. - Check the advisory for the supported way to restrict the MCP protocol if you do not need stdio servers, and apply it.
- Limit chatflow editing rights to the people who need them.
- Run Flowise in a container as a non-root user with no host mounts and minimal environment variables.
- Inventory every MCP server your agents launch, because the same question applies to any agent platform.
Why it matters
The class is described as code injection through a neutralisation failure, CWE-95. In this case the input is the command and environment configuration of a stdio MCP server. The advisory describes two ways around Flowise validation: abusing environment variables that change how python3 behaves, and using the root working directory with node. The pattern is that validating a launch command by looking at its name is not enough when the interpreter honours environment variables or the working directory.
MCP stdio servers are by design local processes started on request. Any product that lets a user define one is giving that user a command line. The safest design is to run such servers in an isolated sandbox, or to let only administrators define them. The KEV flag is false for this CVE.
Quick check
What is a Custom MCP node?
It lets a Flowise chatflow talk to a Model Context Protocol server. In stdio mode the server is a local process that Flowise starts, which is why configuring one is a sensitive action.
Is a network firewall enough?
It helps with outsiders, but the attacker here already has a Flowise account. Upgrade and limit account rights.
Sources
Last reviewed: 18 October 2026.
