Flowise RCE: Unauthenticated Command Execution

The National Vulnerability Database has disclosed CVE-2026-41268, a critical unauthenticated remote command execution (RCE) vulnerability in Flowise, a drag-and-drop UI for building LLM flows. Prior to version 3.1.0, Flowise instances are exposed to arbitrary system command execution with root privileges, requiring no authentication or prior knowledge of the instance.

This RCE is exploitable via a parameter override bypass, specifically leveraging the FILE-STORAGE:: keyword combined with a NODE_OPTIONS environment variable injection. A single HTTP request is all it takes for an attacker to gain control. The National Vulnerability Database assigns this a CVSS score of 7.7 (HIGH), with a vector indicating network-exploitable, low attack complexity, and high impact on confidentiality and integrity.

For defenders, this is a clear and present danger. Unauthenticated RCEs are the crown jewels for attackers, providing immediate and deep access. The ease of exploitation means any internet-facing Flowise instance not yet patched is a sitting duck. This isn’t theoretical; it’s a direct path to compromise.