Flowise MCP Env Case-Sensitivity Bypass — node_options Preload or API Auth Bypass

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects exploitation attempts against the Flowise MCP environment variable case-sensitivity vulnerability. Attackers can leverage a lowercase 'node_options' environment variable on Windows to bypass Flowise security denylists, allowing the injection of arbitrary JavaScript via the Node.js --require flag. The rule also monitors for the execution of associated proof-of-concept (PoC) python scripts and markers.