Flowise MCP node_options Case-Bypass Env Var Injection for Secrets Exfiltration

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•3

Detects Node.js processes being executed with specific require flags or environment variables, while having parent processes or command-line arguments indicative of Flowise integration. This behavior is often associated with the execution of custom MCP (Model Context Protocol) tools or extensions within a Flowise workflow, which could potentially be abused for unauthorized operations or persistence.