Most recent entries from all

EUVD-2026-292835

2026-10-04T06:11:58.400192+00:00

EUVD-2026-292835

fkie_cve-2026-41272

2026-10-04T06:11:58.400279+00:00

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list. This vulnerability is fixed in 3.1.0.

GHSA-2x8m-83vc-6wv4 — Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)

2026-10-04T06:11:58.400374+00:00

Affected: npm: flowise, npm: flowise-components

### Summary The core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list.

### Details The flaws exist in `packages/components/src/httpSecurity.ts`.

Default Insecure: If process.env.HTTP_DENY_LIST is undefined, checkDenyList returns immediately, allowing all requests (including localhost).

DNS Rebinding (TOCTOU): The function performs a DNS lookup (dns.lookup) to validate the IP, and then the HTTP client performs a new lookup to connect. An attacker can serve a valid IP first, then switch to an internal IP (e.g., `127.0.0.1`) for the second lookup.

### PoC Ensure `HTTP_DENY_LIST` is unset (default behavior).

Use any node utilizing secureFetch to access `http://127.0.0.1`.

Result: Request succeeds.

#### Scenario 2: DNS Rebinding

Attacker controls domain attacker.com and a custom DNS server.

Configure DNS to return `1.1.1.1` (Safe IP) with TTL=0 for the first query.

Configure DNS to return `127.0.0.1` (Blocked IP) for subsequent queries.

Flowise validates `attacker.com` -> `1.1.1.1` (Allowed).

Flowise fetches `attacker.com` -> `127.0.0.1` (Bypass).

Run the following for manual verification

```ts // PoC for httpSecurity.ts Bypasses import * as dns from 'dns/promises';

// Mocking the checkDenyL…

WID-SEC-W-2026-1145 — Flowise: Mehrere Schwachstellen

2026-10-04T06:11:58.400583+00:00

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.