Flowise MCP env variable case-sensitivity bypass for secret exposure

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects potential exploitation attempts targeting the Flowise 3.1.2 Custom MCP (Model Context Protocol) stdio interface. The detection monitors for the bypass of environment variable validation where lowercase 'node_options' is used to circumvent security controls blocking 'NODE_OPTIONS', potentially allowing unauthorized code execution via '--require'. It also alerts on the presence of associated PoC artifacts and anomalous outbound network activity from Flowise processes.