A critical vulnerability in the open-source AI platform Flowise has been exposed, posing a significant risk to server security. This flaw, tracked as CVE-2026-40933, allows attackers to gain full control over a server when a logged-in user imports a malicious workflow file. The issue stems from the Custom MCP tool, which enables users to integrate external services into the Model Context Protocol (MCP). When configured with the stdio transport, it launches user-supplied commands without any sandbox protection, making it susceptible to exploitation.
This discovery is not an isolated incident. Obsidian Security, the firm behind the analysis, has previously uncovered a similar remote code execution (RCE) flaw in Langflow, another open-source AI platform. The PoC exploit released alongside the disclosure highlights the ease with which attackers can exploit this vulnerability. The official fix, an input-validation layer, is deemed insufficient as it only treats the symptom rather than the underlying cause.
The vulnerability affects self-hosted deployments of Flowise, with over 52,000 GitHub stars, while the managed Flowise Cloud service remains unaffected. The stdio MCP should be disabled unless explicitly required, as validation checks can be bypassed. The recommended protection is to switch the Custom MCP protocol to Server-Sent Events (SSE), which eliminates the execution path for malicious commands.
This incident underscores the importance of treating imported MCP configurations as code and restricting access to trusted sources. It also highlights the need for robust security measures in AI agent platforms, as the potential for exploitation is high. As AI technology continues to advance, ensuring the security of these platforms becomes increasingly crucial to safeguarding sensitive data and systems.
