Obsidian Security disclosed a critical remote code execution vulnerability, CVE-2026-40933, in the open-source AI platform Flowise and released proof-of-concept exploit code in April 2026. The vulnerability carries a CVSS score of 9.9 and affects self-hosted instances of Flowise by default.

CVE-2026-40933 stems from unsafe serialization of stdio commands in Flowise’s MCP adapter, according to a NIST advisory. The flaw exists in versions of Flowise prior to 3.1.0, which allowed any user to add a new MCP server with an arbitrary command, leading to code execution on the underlying operating system.

Obsidian Security reported that attackers can exploit the vulnerability by convincing a user to import a crafted chatflow. The import action alone triggers arbitrary code execution on the server because Flowise’s Custom MCP node executes the configured command when populating the “Available Actions” dropdown during chatflow rendering.

“Any user who can create or edit chatflows can add a Custom MCP Tool and supply a malicious stdio MCP configuration. In practice, this requires a malicious insider or a compromised user account.” Obsidian notes. “Flowise’s Custom MCP node has an ‘Available Actions’ dropdown that lists the tools exposed by the configured MCP server. To populate that dropdown, the canvas asks the backend to enumerate the server’s tools. With stdio transport, enumeration starts the configured command. Because the dropdown loads when the imported chatflow renders on the canvas, the import alone can spawn the command.”

The published proof-of-concept code demonstrates how an imported chatflow can create a shell back to Docker’s bridge address for the host. Obsidian says successful exploitation leads to “OS-level execution with the Flowise process’s privileges, often root in containerized deployments. Every credential stored in the platform is readable. Every connected service is reachable. Flowise in production is typically wired into databases, APIs, and cloud accounts; the blast radius scales with whatever it connects to.”

Flowise Cloud is not affected because it has stdio MCP disabled. The vulnerability was disclosed alongside several other security defects impacting AI ecosystems that rely on Anthropic’s MCP protocol.