Most recent entries from all

EUVD-2026-275502

2026-10-18T09:40:17.891546+00:00

EUVD-2026-275502

fkie_cve-2026-31829

2026-10-18T09:40:17.891592+00:00

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet. This vulnerability is fixed in 3.0.13.

GHSA-fvcw-9w9r-pxc7 — Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access

2026-10-18T09:40:17.891643+00:00

Affected: npm: flowise, npm: flowise-components

**Description:** Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet.

**Impact includes:** - Access to internal admin panels (e.g., internal company dashboards, Jenkins, Kubernetes API, etc.). - Retrieval of cloud provider metadata (e.g., AWS IMDSv1 at [http://169.254.169.254], GCP, Azure). - Port scanning and enumeration of internal services. - Potential lateral movement or privilege escalation in compromised environments.

This vulnerability is particularly severe because: - Flowise instances are often deployed publicly without authentication (FLOWISE_USERNAME/PASSWORD not set by default). - The HTTP Node is easily accessible in simple flows with minimal configuration.

**Proof of Concept (PoC):** A minimal flow consisting of three nodes demonstrates successful internal network access: Flow Structure: HTTP Node Configuration: The HTTP Node is configured to perform a GET request to an internal address o…

WID-SEC-W-2026-0689 — Flowise: Schwachstelle ermöglicht Manipulation von Dateien

2026-10-18T09:40:17.891732+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Flowise ausnutzen, um serverseitige Request-Forgery-Angriffe durchzuführen, Daten zu manipulieren und vertrauliche Informationen offenzulegen, was möglicherweise eine laterale Bewegung oder eine Ausweitung von Berechtigungen ermöglichen kann.