Flowise MCP node_options case-bypass: --require spawn and SSRF (CVE-2026-20896)
This rule monitors for suspicious activity associated with Flowise Model Context Protocol (MCP) implementations, specifically detecting environment variable bypasses using Node.js --require, potential Server-Side Request Forgery (SSRF) attempts targeting internal infrastructure and cloud metadata services, and the creation of known proof-of-concept (PoC) artifacts.
Microsoft Sentinel (KQL)
