Flowise MCP Env Case Bypass - Child Process, Outbound HTTP, Marker File, or node --require Preload

Ethan Andrews@eandrews

•updated Jun 28, 2026•0•0•2

Detects exploitation of the Flowise MCP environment variable case-sensitivity bypass vulnerability. Adversaries leverage this flaw to circumvent denylist validation by supplying lowercase or mixed-case variable names (e.g., node_options), facilitating malicious code preloading via '--require', unauthorized environment secret exfiltration, or spawning child processes from the Flowise application.