Exploit Code Published for Critical Flowise RCE Vulnerability
Exploit code published for critical Flowise RCE vulnerability (CVE-2026-40933, CVSS 9.9)
Obsidian Security released proof-of-concept exploit code for CVE-2026-40933, a critical remote code execution vulnerability in Flowise, an open-source LLM platform with over 52,000 GitHub stars. The vulnerability stems from unsafe serialization in Anthropic's MCP protocol and allows attackers to execute arbitrary code on self-hosted servers by tricking users into importing a malicious chatflow. Flowise versions before 3.1.0 are vulnerable by default; the attack requires only user import of a crafted JSON chatflow to trigger OS-level code execution with Flowise process privileges.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Anthropic?
Get an email when a new story names Anthropic, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical remote code execution vulnerability in Flowise, an open-source LLM platform, demonstrates how unsafe serialization can lead to complete system compromise. The flaw allows attackers to execute arbitrary code simply by tricking users into importing a malicious JSON chatflow file, leveraging unsafe deserialization in the underlying MCP protocol. With proof-of-concept exploit code now publicly available and over 52,000 organizations potentially using this platform, the vulnerability represents a significant supply chain risk. This incident underscores the importance of secure coding practices in serialization processes and the need for comprehensive input validation in application workflows.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-40933