EUVD-2026-329220

fkie_cve-2026-56275

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud metadata, and enumerate internal services by exploiting the missing secureFetch verification in httpSecurity.ts.

GHSA-9hrv-gvrv-6gf2 — Flowise Execute Flow function has an SSRF vulnerability

Affected: npm: flowise, npm: flowise-components

### Summary

The attacker provides an intranet address through the base url field configured in the Execute Flow node → Bypass checkDenyList / resolveAndValidate in httpSecurity.ts (not called) → Causes the server to initiate an HTTP request to any internal network address, read cloud metadata, or detect internal network services

### Details

Then initiate the call:

``` POST /api/v1/prediction/d6739838-d3b3-43d9-86ff-911a3d757a7e HTTP/1.1 Host: 127.0.0.1:3000 Content-Type: application/json Authorization: Bearer apikey Content-Length: 17

{"question": "1"} ```

Server received a request:

And there is an echo:

Fix: Call secureFetch for verification

### Impact

This is a Server-Side Request Forgery (SSRF) vulnerability that may lead to the following risks: - Explore Internal Web Applications - Access sensitive management interfaces - Leak internal configuration, credentials, or confidential information

This vulnerability significantly increases the risk of internal service enumeration and poten…

WID-SEC-W-2026-1145 — Flowise: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.

Most recent entries from all

EUVD-2026-329220

fkie_cve-2026-56275

GHSA-9hrv-gvrv-6gf2 — Flowise Execute Flow function has an SSRF vulnerability

WID-SEC-W-2026-1145 — Flowise: Mehrere Schwachstellen