source code free stock image for MCPwatch editorial use

17 CVEs Hit n8n and Flowise: MCP Endpoints Are the Weakest Link

by
source code free stock image for MCPwatch editorial use
Topic image: source code free stock image for MCPwatch editorial use.

What Happened

On June 25, 2026, two widely deployed AI workflow platforms disclosed a combined 17 critical and high-severity vulnerabilities. n8n, the open-source workflow automation platform increasingly used as an AI agent orchestration layer, published 11 CVEs. Flowise, the drag-and-drop LLM application builder, published 6 CVEs. Both disclosures include CVSS 10.0 vulnerabilities, and in both platforms the MCP endpoints are the most dangerous attack vectors.

The pattern is clear: the tools enterprises deploy to become “AI-native” are the least secure software in their stacks. MCP endpoints designed to give AI agents powerful capabilities — browser control, code execution, database access — are exposing those same capabilities to unauthenticated attackers.

n8n: MCP Browser-Control Without Authentication

The most severe finding is CVE-2026-54309 (CVSS 10.0). When the @n8n/mcp-browser component runs in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the user, can establish an MCP session and invoke browser-control tools. Where the n8n AI Browser Bridge extension is installed and a browser connection is live, an unauthenticated attacker can:

  • Navigate pages in the user’s real browser profile
  • Evaluate arbitrary JavaScript
  • Access cookies and web storage
  • Intercept browser sessions

This is a CWE-306 weakness (Missing Authentication for Critical Function). No login, no API key, no authorization — just reach the endpoint and take control.

Fixed in: n8n 2.25.7 and 2.26.2. If immediate upgrade is not possible, disable HTTP transport for @n8n/mcp-browser by removing or commenting out the --transport http setting.

n8n: Three More CVSS 9.9 Vulnerabilities

Three additional n8n CVEs scored 9.9:

  • CVE-2026-54310 (CVSS 9.9) — SQL injection in the TimescaleDB and Postgres nodes. These are the database connectors that AI workflows use to read and write production data. An authenticated user can inject arbitrary SQL through crafted table names, potentially exfiltrating data from adjacent databases.
  • CVE-2026-44789 (CVSS 9.9) — Global prototype pollution via the HTTP Request node’s pagination parameter. An authenticated user who can create or modify workflows can pollute Object.prototype in the n8n server process, then chain it with task-runner spawning to achieve remote code execution. Fixed in n8n 1.123.43, 2.20.7, and 2.22.1.
  • CVE-2026-44791 (CVSS 9.9) — A patch bypass for CVE-2026-42232, which was an earlier XML node RCE vulnerability. The new vector circumvents the prior fix and restores the same RCE capability through a different attack surface. This fix-break-fix pattern is characteristic of rapidly evolving AI tooling where features ship faster than security reviews.

n8n: Cross-User Data Interception

CVE-2026-54311 (CVSS 7.7) enables sandbox context pollution in the Merge node’s SQL Query mode. Because the sandbox context is cached and reused across all workflow executions on the instance, prototype mutations introduced by one user’s workflow persist into subsequent Merge SQL executions belonging to other users or projects. In multi-tenant deployments, one user’s workflow can intercept another’s data. Fixed in 2.25.7 and 2.26.2.

Flowise: CVSS 10.0 Path Traversal to RCE

CVE-2025-71338 (CVSS 10.0) is an unauthenticated path traversal vulnerability in Flowise’s /api/v1/document-store/loader/process endpoint. Attackers can write arbitrary files to the filesystem, overwriting critical configuration files like package.json to achieve remote code execution on application restart. No authentication is required.

Flowise: MCP Feature Enables RCE

CVE-2025-71336 (CVSS 9.8) enables unsandboxed remote code execution through the Custom MCP Server feature, which is designed to execute OS commands such as launching local MCP servers. A crafted JSON payload achieves arbitrary code execution on the server. The mechanism designed to let AI agents interact with tools becomes the attack vector.

CVE-2026-56274 (CVSS 9.9) extends this pattern: Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. Any Flowise user, regardless of role, can exploit this. As of disclosure, no patch was available.

Flowise: Environment Variable Bypass on Windows

CVE-2026-58057 affects Flowise before 3.1.3 on Windows. The Custom MCP stdio environment variable denylist uses case-sensitive comparison. On Windows, where environment variable names are case-insensitive, supplying node_options bypasses the NODE_OPTIONS denylist entry. An authenticated user who can configure a Custom MCP node can inject NODE_OPTIONS --require and execute arbitrary code. Fixed in Flowise 3.1.3.

Flowise: Auth Bypass and Credential Exposure

Two more Flowise CVEs round out the picture:

  • CVE-2025-71327 (CVSS 9.1) — Authentication bypass via an unprotected account registration endpoint. If /api/v1/account/register is reachable, anyone can create an admin account.
  • CVE-2026-56270 (CVSS 7.5) — SSO configuration including OAuth client secrets exposed in cleartext.
  • CVE-2026-56275 (CVSS 7.5) — SSRF through the Execute Flow node, potentially reaching cloud metadata services at 169.254.169.254 to steal IAM credentials.

The Structural Problem

These 17 CVEs are not isolated. They follow a clear pattern that MCPwatch has been tracking and see our incident coverage: AI agent infrastructure is deployed with security models designed for internal tools, not internet-facing attack surfaces.

n8n was built as a workflow automation tool. Flowise was built as a prototyping platform. Both are now deployed as production AI agent infrastructure — exposed to the internet, connected to production databases, and granted browser control capabilities. The MCP pattern of granting AI agents the ability to control browsers, execute code, and access databases means these platforms need more scrutiny than traditional web applications, not less.

The fix-break-fix pattern seen in n8n’s XML node RCE (CVE-2026-42232 → CVE-2026-44791) and the fact that Flowise’s Custom MCP feature is now responsible for three separate RCE paths (CVE-2025-71336, CVE-2026-56274, CVE-2026-58057) both indicate that MCP-facing code is receiving insufficient security review relative to its power.

Operator Checks

If you are running n8n:

  • Upgrade to 2.25.7 or 2.26.2 immediately
  • If your n8n instance is internet-accessible with MCP endpoints enabled, assume compromise until you can verify otherwise — CVE-2026-54309 requires no authentication
  • Disable HTTP transport for @n8n/mcp-browser if immediate upgrade is not possible
  • Audit TimescaleDB and Postgres node configurations for unexpected query patterns
  • Review shared instances for cross-user data exposure (CVE-2026-54311)

If you are running Flowise:

  • Upgrade to 3.1.3 or later
  • Audit whether the /api/v1/account/register endpoint was ever reachable from outside your network
  • Disable the Custom MCP Server feature if you do not need it
  • On Windows, verify NODE_OPTIONS denylist behavior after 3.1.3 upgrade
  • Check for unexpected SSO configuration changes (CVE-2026-56270)

For all MCP operators, see our incident archives for prior MCP security events:

  • Treat AI workflow platforms with the same security rigor as databases — they have equivalent access to production data and equivalent ability to execute code
  • Network-segment MCP endpoints; do not expose them to the internet without authentication
  • Monitor MCP endpoint access logs for unauthorized session initialization
  • Review MCP authorization fundamentals and the MCP Server Security Checklist

Sources

1 thought on “17 CVEs Hit n8n and Flowise: MCP Endpoints Are the Weakest Link”

  1. Pingback: MCPwn (CVE-2026-33032): First Confirmed In-the-Wild MCP Exploit Hits nginx-ui - MCPwatch.tech

Leave a Comment