CVE-2025-8943
CRITICAL EXPLOITED NUCLEIFlowise < 3.0.1 - Unauthenticated Remote Code Execution via Custom MCPs Feature
Title source: llmExploitation Summary
CVE-2025-8943 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 1 public exploit from researchers including Assaf Levkovich, including a Metasploit module exploits/multi/http/flowise_custommcp_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits a remote code execution vulnerability in Flowise via the customMCP endpoint, allowing arbitrary command execution through the StdioClientTransport mechanism. It supports both authenticated and unauthenticated exploitation depending on Flowise configuration.
Description
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.
Exploits (1)
This Metasploit module exploits a remote code execution vulnerability in Flowise via the customMCP endpoint, allowing arbitrary command execution through the StdioClientTransport mechanism. It supports both authenticated and unauthenticated exploitation depending on Flowise configuration.
Nuclei Templates (1)
http.title:"Flowise"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H