Attack Chain

1. Attacker creates or obtains an API key with minimal permissions (e.g., tools:view) via legitimate account access.
2. Attacker inspects the /api/v1/files endpoint to identify accessible file paths.
3. Attacker sends a GET request to /api/v1/files using their low-privileged Authorization: Bearer token.
4. The application logic fails to check activeWorkspaceId, returning a list of all files across the entire organization.
5. Attacker parses the JSON response to extract paths belonging to target workspaces.
6. Attacker sends a DELETE request to /api/v1/files with the path parameter set to a file located in a foreign workspace.
7. The application performs the deletion using the organization ID context, successfully removing the unauthorized file.

Impact

Successful exploitation results in the unauthorized exposure of file metadata and destructive tampering of workspace data. An attacker can systematically delete files across an entire organization, leading to significant data loss and disruption of business processes for affected users and workspaces.

Recommendation

• Update Flowise to a version where CVE-2026-69252 is patched.
• Implement request monitoring for the /api/v1/files endpoint to identify users accessing paths outside their assigned workspace directory.
• Deploy the Sigma rule below to detect unauthorized file deletion attempts by low-privileged API keys.

Because Flowise defaults to an unauthenticated state, a remote attacker can interact with the API to register a malicious MCP server. By including specific environment variables in the configuration, an attacker can influence the behavior of npx, node, or python3 to achieve remote code execution. This is a classic case of incomplete denylisting, where developers attempted to enumerate dangerous inputs rather than implementing a secure allowlist, leaving the environment vulnerable to various configuration injection vectors.

Attack Chain

1. Attacker discovers an internet-facing, unauthenticated Flowise instance.
2. Attacker interacts with the Flowise API to create or update an MCP server configuration.
3. Attacker crafts a JSON payload containing the mcpServers object with a command like npx.
4. Attacker inserts environment variables such as npm_config_yes=true into the env field of the payload.
5. Flowise validation logic (validateCommandFlags) is bypassed because the CLI flags are clean.
6. Flowise validation logic (validateEnvironmentVariables) is bypassed because the blocklist only contains four hardcoded entries (PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, NODE_OPTIONS).
7. Flowise spawns the npx process, which reads the injected environment variable and proceeds with automatic package installation.
8. Malicious code is executed under the privileges of the Flowise process, resulting in full system compromise.

Impact

Successful exploitation results in unauthenticated remote code execution on the server running Flowise. Given the tool's nature as an LLM integration platform, successful compromise often grants an attacker access to connected sensitive data, API keys for AI providers, and internal network resources. All versions up to and including 3.1.2 are confirmed to be vulnerable.

Recommendation

1. Upgrade to a version of Flowise that implements an allowlist-based validation approach for environment variables rather than a denylist.
2. Implement strict authentication on all Flowise API endpoints to prevent unauthenticated access to configuration interfaces.
3. Restrict outbound network access for the server running Flowise to prevent the automatic installation of arbitrary npm/pip packages from the internet.
4. Ensure that the service account running the Flowise process operates with the principle of least privilege, minimizing the damage from a successful code execution event.