Flowise MCP node_options Case-Bypass RCE — Marker File or Child Spawn

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects indicators of active exploitation or malicious activity targeting the Flowise application. The rule triggers on the creation of a 'flowise_marker.txt' file, the spawning of node processes with suspicious command-line flags ('--require', 'node_options') potentially intended to bypass security controls, and the execution of unexpected shell or scripting processes (cmd, bash, python, etc.) by a Flowise process.