Most recent entries from all

EUVD-2026-275502

fkie_cve-2026-31829

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet. This vulnerability is fixed in 3.0.13.

GHSA-fvcw-9w9r-pxc7 — Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access

Affected: npm: flowise, npm: flowise-components

**Description:** Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet.

**Impact includes:** - Access to internal admin panels (e.g., internal company dashboards, Jenkins, Kubernetes API, etc.). - Retrieval of cloud provider metadata (e.g., AWS IMDSv1 at [http://169.254.169.254], GCP, Azure). - Port scanning and enumeration of internal services. - Potential lateral movement or privilege escalation in compromised environments.

This vulnerability is particularly severe because: - Flowise instances are often deployed publicly without authentication (FLOWISE_USERNAME/PASSWORD not set by default). - The HTTP Node is easily accessible in simple flows with minimal configuration.

**Proof of Concept (PoC):** A minimal flow consisting of three nodes demonstrates successful internal network access: Flow Structure: <img width="1131" height="323" alt="image" src="https://github.com/user-attachments/assets/f6ddc74f-3ae9-4376-995a-693fb272627a" /> HTTP Node Configuration: The HTTP Node is configured to perform a GET request to an internal address o…

WID-SEC-W-2026-0689 — Flowise: Schwachstelle ermöglicht Manipulation von Dateien

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Flowise ausnutzen, um serverseitige Request-Forgery-Angriffe durchzuführen, Daten zu manipulieren und vertrauliche Informationen offenzulegen, was möglicherweise eine laterale Bewegung oder eine Ausweitung von Berechtigungen ermöglichen kann.