Case flowise-rce-exploitedAgent hijackWorldwide
Max-severity Flowise CustomMCP RCE (CVE-2025-59528) exploited in the wild
Attackers began exploiting JavaScript injection in Flowise's CustomMCP node to run code on AI workflow servers, with 12,000-15,000 instances exposed online.
CriticalAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Apr 7, 2026
- Location
- Worldwide
- Target
- Flowise AI agent builder
- Severity
- Critical
- Triggered by
- Unknown attacker operating from a single Starlink IP
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- CVE-2025-59528
What happened
Attackers began exploiting JavaScript injection in Flowise's CustomMCP node to run code on AI workflow servers, with 12,000-15,000 instances exposed online.
Impact: Remote code execution on exposed Flowise servers; exploitation limited to one source IP at time of reporting; number of compromised instances unknown
Who triggered it
Actor: Unknown attacker operating from a single Starlink IP
Attribution: No public attribution; exploitation detected by VulnCheck Canary honeypot network
Motive: Unknown; likely opportunistic server takeover
How it happened
Attack vector: Malicious mcpServerConfig string sent to Flowise CustomMCP node, which evaluated it via the JavaScript Function() constructor with full Node.js privileges; only an API token required
Root cause: CustomMCP node executed user-supplied configuration as JavaScript without validation, giving access to child_process and fs modules
Timeline
- Flaw disclosed and patched in Flowise 3.0.6; CVE-2025-59528 assigned with CVSS 10.0
- VulnCheck reports first in-the-wild exploitation; 12,000-15,000 instances exposed online
- BleepingComputer and others urge upgrade to 3.1.1 or later
Response
Vendor fix already available (3.0.6+); researchers urged upgrading, removing instances from the internet and rotating API tokens; VulnCheck shared signatures with customers
Current status: Patched
Sources (open in a new tab)
- BleepingComputer bleepingcomputer.com
- The Hacker News thehackernews.com
- Security Affairs securityaffairs.com
- SecurityWeek securityweek.com
Cite this case
Max-severity Flowise CustomMCP RCE (CVE-2025-59528) exploited in the wild. AI Threat Watch, case flowise-rce-exploited, Apr 7, 2026. https://aithreat.io/cases/flowise-rce-exploited/
Permanent link: https://aithreat.io/cases/flowise-rce-exploited/