CVE-2026-91931

This is a flaw in a Flowise feature that can be used to add external tools. It is like allowing a staff member to order supplies for the office but letting them choose an unverified delivery person who can then enter the building and do anything they want.

This matters to you if you run Flowise, especially if administrators or other users can configure Custom MCP connections. An attacker must already have a valid Flowise login to use this issue.

No known public attacks or public attack code have been reported, but a successful attacker with a login can take control of the Flowise server. Treat this as a near-term upgrade: restrict access to the affected feature and schedule the update promptly.

Confirm the deployed Flowise version and identify whether any Custom MCP node uses mcpServerConfig with npx package names. Upgrade every affected deployment to Flowise 3.1.4; no separate fixed branches are identified in the available findings. Review release notes and test the upgrade in a non-production environment first, as compatibility or breaking-change information is not yet known. If patching is delayed, disable Custom MCP nodes that invoke npx, or ensure only tightly controlled administrator accounts can edit their configuration. No CISA KEV remediation due date applies because this CVE is not listed in KEV. After remediation, investigate process and package-manager records for unexpected npx executions, unfamiliar npm packages, or suspicious server-side child processes.

CVE-2026-91931 is CVSS 8.5 High (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) and maps to CWE-78. The attack requires low-privileged authentication but no user interaction; attacker-controlled npx package names in Custom MCP mcpServerConfig can cause arbitrary code execution through npm package execution. It is not listed in CISA KEV, no public exploit code is on record, and EPSS is 0.6% (49th percentile) with a flat trend. Press attention is new, but that does not establish active exploitation.