CVE-2026-73601
Flowise before 3.1.3 Remote Code Execution via Custom MCP
CVSS score
9.0
EPSS probability
%1.1
Risk score
0.1
Published
2 mo ago
Related Security News
Articles and analysis bulletins in which the press and security publications have covered this vulnerability:
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More
The boring parts caused most of the trouble. A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional. Elsewhere, fake apps, helpful support calls, cheap banking kits, exposed systems, and weak defaults kept
Similar Vulnerabilities
10.0
CVE-2025-59528Code injection in Flowiseai
Patch status unknown Public Exploits:3EPSS %86
9.8
CVE-2025-8943Missing authentication in Flowiseai
Patch status unknown Public Exploits:2EPSS %75
9.8
CVE-2025-26319Unrestricted file upload in Flowiseai
Patch verified Public Exploits:3EPSS %56
9.8
CVE-2025-58434Missing authentication in Flowiseai
Patch verified Public Exploits:3EPSS %50
9.9
CVE-2025-61913Path traversal in Flowiseai
Patch verified Public Exploits:2EPSS %13
8.8
CVE-2025-61687Unrestricted file upload in Flowiseai
Patch status unknown Public Exploits:1EPSS %11
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-73601"