Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)
Flowise versions before 3.0.1 let an attacker run operating system commands on the server without logging in. The flaw sits in the Custom MCP feature, which passes attacker-supplied configuration straight into a command execution function.
How the attack works
An attacker sends a POST request to the /api/v1/node-load-method/customMCP endpoint with a mcpServerConfig field containing a command and args, and sets loadMethod to listActions. If Flowise has no FLOWISE_USERNAME/PASSWORD configured, the attacker adds an x-request-from: internal header to bypass authentication entirely. Flowise then passes the command and args directly to an unsandboxed OS execution call (StdioClientTransport), running whatever the attacker specified. This gives the attacker code execution on the host running Flowise.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 64affe49-0a63-4ef3-9bff-692bfbafe1f6
- Severity
- Critical
- CVEs
- CVE-2025-8943
Why it matters
An attacker can take full control of the server running Flowise without needing any credentials, exposing any data, credentials, or connected systems accessible from that host.
What you can do
- →Upgrade Flowise to 3.0.1 or later immediately.
- →Configure FLOWISE_USERNAME and FLOWISE_PASSWORD so the instance is not left unauthenticated.
- →Restrict or filter the x-request-from header at your reverse proxy so external requests cannot spoof internal-only access.
- →Review network exposure of the /api/v1/node-load-method/customMCP endpoint and restrict it to trusted internal callers only.
Known benign look-alikes
- Legitimate Flowise Custom MCP node configuring a real local MCP server (e.g. command npx, args @modelcontextprotocol/server-filesystem) without the listActions loadMethod probe shape.
- Generic MCP server JSON config containing command/args keys, which is standard and benign across thousands of MCP clients.
- Flowise documentation or patch advisory referencing the node-load-method endpoint without an exploit payload or the internal auth-bypass header.