CVE-2026-91932

Flowise before 3.1.4 Remote Code Execution via cwd Parameter

Published: Sep 15, 2026Updated: Sep 16, 2026 Sources: CVE List NVDCWE-20

8.5HIGH

Description

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working directory to execute malicious code.

In plain language

AI Worth attention

Flowise versions before 3.1.4 let a logged-in attacker run harmful code, so businesses using those versions should schedule an upgrade.

Executive summary

Authenticated RCE in Flowise before 3.1.4 via a validation bypass in MCP server configuration that allows control of the cwd parameter.

If affected, business impact

Flowise server takeoverData theftWorkflow disruptionMalicious code execution

What to do now

Check the installed Flowise version and whether users can change MCP server configurations.
Upgrade Flowise to version 3.1.4 or later.
Until upgraded, limit MCP configuration access to trusted administrators and review recent configuration changes.

Usually a quick update

What is it

This flaw can let someone with a Flowise login make the server run instructions it should refuse. It is like giving an approved visitor access to the building but allowing them to redirect staff into an unrestricted back room.

Who is affected

This matters to you if you run Flowise, especially if multiple people can log in and edit MCP server configurations. An attacker needs a valid login and access to that configuration feature.

How urgent is it

An attacker with a Flowise login can use this weakness to take control of the server, which makes this an amber-priority issue. No public exploit code is on record and it is not listed in CISA's known-exploited catalog, but upgrade on your normal near-term maintenance schedule.

What to do — in detail

Confirm the deployed Flowise version from your package, container image, deployment records, or application version screen.
Identify accounts and roles permitted to create or edit MCP server configurations; review recent changes to those configurations for unexpected working-directory values or arguments.
Upgrade every Flowise deployment to 3.1.4 or later, then restart or redeploy the service as required by your installation method.
If upgrading is delayed, restrict MCP server configuration changes to trusted administrators and temporarily disable or remove unneeded MCP server configurations.
Monitor Flowise configuration audit activity, host process execution, and outbound connections for unexpected activity after the upgrade. CISA has not assigned a KEV remediation due date because this CVE is not in KEV.

Technical context

CVE-2026-91932 is rated CVSS 8.5 High (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) and is classified as CWE-20, improper input validation. In Flowise before 3.1.4, an authenticated attacker can bypass path validation in MCP server configuration by using clean filenames in the args array while controlling cwd, resulting in remote code execution. No public exploit code is recorded, CISA KEV does not list the CVE, and EPSS estimates a 0.8% likelihood (56th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:HAttack Complexity

High

PR:LPrivileges Required

Low

UI:NUser Interaction

None

Scope

S:CScope

Changed

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-20

Affected Products

FlowiseAI

oss-projectaka flowise-components, flowise, embed

FlowiseOn-premWeb App

AI / ML / ai-agent-tooling

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Is your org exposed to CVE-2026-91932?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Initial Access

View detailed technique mapping

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x7x8-95gh-42xm

github.com

https://www.vulncheck.com/advisories/flowise-before-3.1.4-remote-code-execution-via-cwd-parameter

vulncheck.com

News mentions

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
en·The Hacker News·Sep 21, 2026 Exploited Cisco Identity Services Engine zero-day

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-91932 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows