What is the CVSS score of CVE-2026-31829?

CVE-2026-31829 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-31829?

Yes, a public proof-of-concept exploit is available for CVE-2026-31829. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-31829?

Within 24 hours: Identify all Flowise instances in production and document their version numbers and network exposure; isolate any publicly accessible instances or restrict access to trusted networks only. Within 7 days: Implement network segmentation to limit Flowise outbound HTTP/HTTPS traffic to approved destinations only; apply WAF rules to block suspicious HTTP Node activity. Within 30 days: Upgrade to Flowise 3.0.13 or later when patch availability is confirmed; conduct a security audit of all Flowise deployments and review access logs for exploitation attempts.

Flowise CVE-2026-31829

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-10 security-advisories@github.com

GHSA-fvcw-9w9r-pxc7

SSRF AI / ML Flowise Flowiseai

7.1

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Access public Flowise chatflow
Exploit

Create HTTP Node with internal IP URL
Execution

Trigger server-side request
Impact

Access restricted internal resources

Vulnerability Assessment

Weakness	CWE CWE-918 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V4 - API and Web Service URL allowlisting, SSRF prevention MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Flowise version prior to 3.0.13 with publicly exposed Chatflow or AgentFlow containing HTTP Node; user must have authenticated access (PR:L) to interact with the flow; no URL filtering on RFC 1918 ranges, localhost, or metadata endpoints enabled by default.
Impact	CVSS 7.1 (HIGH). Attack vector: Network. Complexity: High. Privileges required: Low. User interaction: None. Exploitable via remote/network. Public exploit/POC available.
Exploit ScenarioDerived	A remote attacker could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Flowise versions prior to 3.0.13 allow unauthenticated users to trigger Server-Side Request Forgery (SSRF) attacks through improperly validated URLs in the HTTP Node component, enabling attackers to probe internal networks and cloud metadata endpoints from the Flowise server. Public exploit code exists for this vulnerability, and no patch is currently available for affected deployments. Any organization running a publicly exposed Flowise instance is at immediate risk of internal network reconnaissance and potential credential theft from cloud environments.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 7.1

RemediationAI

Fixed in version 3.0.13.. Restrict network access to the affected service where possible.

Affected Packages

npm flowise fix: 3.0.13

npm flowise-components fix: 3.0.13

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects Flowise. Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Fl

Know when Flowise gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 11, 2026 - 14:24 vuln.today

Public exploit code

CVE Published

Mar 10, 2026 - 22:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet. This vulnerability is fixed in 3.0.13.

Executive ViewAI

Why It Matters

Flowise versions prior to 3.0.13 contain a critical server-side request forgery (SSRF) vulnerability that allows attackers to exploit unpatched instances to perform unauthorized HTTP requests from your infrastructure. Organizations running affected Flowise deployments face immediate risk of data exfiltration, lateral network movement, and potential compromise of internal systems.

Business Impact: High

Compensating Controls

Implement network-level controls: restrict Flowise outbound traffic via firewall rules to only necessary endpoints; deploy Web Application Firewall (WAF) rules to block HTTP Node requests to internal IP ranges and private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16); disable or remove HTTP Node functionality if not essential to operations; segment Flowise on isolated network with limited east-west connectivity; implement strict URL validation rules if custom configuration is available; monitor outbound connections from Flowise instances for anomalous activity.

Threat Intelligence Overview

EPSS Score

0.0%

Top 87% exploitable

Threat Intel

1 source

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS GHSA

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Server-Side Request Forgery HIGH

Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*

More in Flowise

View all

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2025-8943 CRITICAL Emergency POC

9.8 Aug 14

Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c

CVE-2025-26319 CRITICAL Emergency POC

9.8 Mar 04

FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una

CVE-2025-61913 CRITICAL Act Now POC

9.9 Oct 08

Arbitrary file read and write in Flowise versions prior to 3.0.8 allows an authenticated attacker with access to the flo

CVE-2026-56274 HIGH Act Now POC

8.7 Jun 23

Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per

CVE-2025-58434 CRITICAL Act Now POC

9.8 Sep 12

Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9

CVE-2025-61687 HIGH Act Now POC

8.8 Oct 06

Authenticated users can upload arbitrary files to Flowise 3.0.7 due to missing validation, enabling persistent storage o

CVE-2026-30821 CRITICAL Act Now POC

9.8 Mar 07

Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent

CVE-2026-30824 CRITICAL Act Now POC

9.8 Mar 07

Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi

CVE-2025-34267 HIGH This Week POC

8.4 Oct 14

Authenticated remote code execution in FlowiseAI Flowise (v3.0.1 up to but not including 3.0.8, and later versions when

CVE-2026-70470 CRITICAL Act Now POC

9.5 Aug 04

Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat

CVE-2026-69264 CRITICAL Act Now POC

9.4 Aug 04

Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all

CVE-2021-34473 CRITICAL POC

9.1

CVE-2021-26855 CRITICAL POC

9.1

CVE-2021-21985 CRITICAL POC

9.8

CVE-2022-41040 HIGH POC

8.8

CVE-2024-21893 HIGH POC

8.2

CVE-2021-40438 CRITICAL POC

9.0

CVE-2021-22054 HIGH POC

7.5

CVE-2021-21975 HIGH POC

7.5

Same technique SSRF

View all

CVE-2016-3718 MEDIUM POC

5.5

References

Advisories & patches

ADVISORY https://vuldb.com/?id.350215

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back