CVE-2026-46442: Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

Synopsis

An authenticated remote code execution vulnerability affects Flowise, the drag-and-drop LLM flow builder. Any authenticated user or API key holder can submit arbitrary JavaScript to the POST /api/v1/node-custom-function endpoint, which, in the common deployment case where E2B_APIKEY is not set, executes that code inside a NodeVM sandbox that can be escaped to reach the host process and run system commands. Successful exploitation gives the attacker full command execution on the Flowise server host. A patched-image rebuild at version 3.1.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to reach the Flowise HTTP API from across the network.

• AuthenticationRequired

  Any low-privilege account or valid API key is sufficient; no administrative access is needed.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends a crafted HTTP request directly to the endpoint.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental layout are required to escape the NodeVM sandbox.

Blast Radius

• Attacker executes arbitrary operating system commands on the Flowise server host via child_process after escaping the NodeVM sandbox.
• All files, environment variables, and secrets accessible to the Flowise process (including database credentials, API keys, and LLM provider tokens) are readable.
• The attacker can modify or delete persisted flow configurations, stored credentials, and any data on filesystems mounted to the host.
• Compromise extends to systems reachable from the Flowise host, as the attacker controls a full shell on the server (CVSS v4 downstream Scope tokens SC:H, SI:H, SA:H indicate high impact on subsequent systems).