Flowise MCP Env Variable Case-Sensitivity Bypass - node_options or FLOWISE_ Leak

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects potential exploitation attempts against Flowise by monitoring for suspicious child process creation. The rule flags Node.js processes spawned by Flowise that utilize case-insensitive command-line bypass patterns or reference suspicious environment variables, which may indicate an attempt to override security configurations through environment variable manipulation (e.g., node_options).