Flowise CustomMCP: Configuration Text Becomes Server Code

Replace affected Flowise builds with 3.0.6 or a later supported fixed release and verify the running node-load-method handler. The decisive patch parses configuration with JSON5 instead of evaluating it with Function. In an isolated test, confirm malicious configuration text produces no process or filesystem side effect while valid MCP configuration still works; account for every deployed worker and ingress route.

For managed deployments, put Flowise administration and node-load-method routes behind a workload-OIDC gateway that verifies signature, issuer, audience, lifetime and required scope, and deny direct backend access. This blocks an unauthenticated Internet caller only where that boundary is actually enforced. The advisory reproduction uses bearer authorization, so a malicious authorized caller still requires the code-evaluation patch; do not label all affected installations universally unauthenticated.

A Flowise operator can contain the entire vulnerable Node.js service in an externally enforced microVM or userspace-kernel runtime, with only required data mounts and no host Docker socket or management credential. Verify the actual runtime and deny a normal-container fallback. This limits host-level consequences of Function-based execution but leaves any data and credentials deliberately available inside the guest exposed. It needs a compatible managed deployment and does not replace the JSON5 parser repair.