Incident Overview
On April 7, 2026, attackers began exploiting a critical remote code execution (RCE) vulnerability, identified as CVE-2025-59528, in Flowise, an open-source platform designed for building custom AI agentic systems and LLM-based workflows. The flaw resides in the Flowise CustomMCP node, which allows users to configure connections to external Model Context Protocol (MCP) servers. The vulnerability enables arbitrary JavaScript code injection without security validation, leading to command execution and full file system access on affected servers. At the time of exploitation, over 12,000 Flowise instances were exposed online, though the exact number of vulnerable servers remains unclear.
The vulnerability was first disclosed in September 2025, with warnings that successful exploitation would grant attackers full control over compromised systems. Flowise addressed the issue in version 3.0.6, and the latest stable release, 3.1.1, was made available two weeks prior to the confirmed exploitation. Despite the patch, active scanning and exploitation attempts were detected as early as April 7, 2026, by vulnerability intelligence firm VulnCheck, which observed activity originating from a single Starlink IP address.
Flowise is widely used across industries, including developers prototyping AI systems, non-technical users employing no-code toolsets, and organizations deploying customer support chatbots and knowledge-based assistants. The platform’s drag-and-drop interface simplifies the creation of AI workflows, but its reliance on user-provided configurations introduces significant security risks when input validation is absent.
The report noted a broader trend of attackers targeting AI orchestration layers and supply chains, with misconfigured permissions and weak validation controls enabling remote code execution and unauthorized access.
Possible Root Cause
The root cause of CVE-2025-59528 lies in the Flowise CustomMCP node’s handling of the mcpServerConfig input. During configuration, the node evaluates this input without sanitization or validation, allowing attackers to inject malicious JavaScript code. This design flaw enables arbitrary command execution on the underlying server, as the injected code is processed with the same privileges as the Flowise application itself.
The vulnerability stems from treating external tool-calling surfaces—such as MCP connections—with the same trust level as internal infrastructure. This approach is systemic across AI frameworks, where unsanitized input in configuration layers can lead to severe exploitation.
Additionally, the delay between disclosure (September 2025) and active exploitation (April 2026) suggests that some organizations may have overlooked the patch or failed to prioritize updates. The exposure of thousands of instances also indicates a lack of default security hardening, such as restricting public access to AI development tools unless explicitly required.
Takeaways
The exploitation of CVE-2025-59528 demonstrates critical risks associated with unsanitized input in AI orchestration platforms.
- Immediate patching is non-negotiable: Organizations using Flowise or similar AI development tools must upgrade to patched versions (3.0.6 or later) without delay. The gap between disclosure and exploitation highlights the urgency of applying security updates in high-risk environments.
- Input validation is essential: AI frameworks must enforce strict validation for all user-provided configurations, particularly in tool-calling surfaces like MCP.
- Minimize exposure: Publicly accessible AI development instances should be restricted unless necessary. Default configurations should assume adversarial intent and enforce network segmentation to limit lateral movement.
- Audit tool-calling surfaces: The vulnerability pattern suggests similar risks may exist in other AI frameworks. Organizations should conduct comprehensive audits of their AI stacks to identify and mitigate unsanitized input paths in configuration layers.
- Monitor for exploitation: VulnCheck’s detection of active scanning indicates that attackers systematically probe for known vulnerabilities. Organizations should deploy network signatures, YARA rules, and intrusion detection systems to detect early signs of exploitation.
- Supply chain risks persist: The incident aligns with OWASP’s findings that third-party AI tools introduce significant supply-chain vulnerabilities. Organizations must vet dependencies and enforce rapid patching cadences for open-source components.
The Flowise RCE incident serves as a case study in how design flaws in AI orchestration layers can be weaponized at scale. It also reflects broader trends in AI security, where misconfigured permissions, excessive autonomy, and weak validation controls enable cascading failures. Moving forward, securing AI systems requires a shift from model-level safeguards to holistic security controls across identity, infrastructure, and operational workflows.