Flowise CVE-2026-41270

Exploitation requires an authenticated session or valid API key and the ability to create or run a Custom Function node (PR:L). The bypass specifically abuses the native Node.js http, https, and net modules, which are in the NodeVM sandbox's defaultAllowBuiltInDep allowlist while only axios and node-fetch are wrapped with HTTP_DENY_LIST enforcement. Meaningful impact further requires that the Flowise host can actually reach a valuable internal target - the AC:H rating and the advisory's own PoC prerequisites tie full impact to deployment on a cloud instance (e.g., AWS EC2 with an attached IAM role exposing 169.254.169.254). Limiting factors: not automatable at scale (each target needs credentials and a reachable internal endpoint), no unauthenticated path, and instances with no reachable internal/metadata services yield little of value.

The signals are consistent but point to targeted rather than mass exploitation. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, C:H/I:H/A:L, 7.1 High) reflects network reach but requires an authenticated user (PR:L) and high complexity (AC:H) - realistically because meaningful impact depends on the Flowise host having reachable internal targets like a cloud metadata service. SSVC corroborates this: Exploitation=poc (code exists, not observed in the wild), Automatable=no (each target needs a valid session and a reachable internal endpoint), Technical Impact=total. EPSS is very low (0.04%, 11th percentile) and there is no CISA KEV listing, so this is not a spray-and-pray internet threat. It is nonetheless a genuine priority for any Flowise deployment on a cloud instance with an attached IAM role or accessible internal services, where the total technical impact (credential/secret theft) is severe. Note a mild tension worth verifying: the description frames the flaw as an SSRF bypass (confidentiality/exfiltration focused), yet the CVSS assigns I:H - the integrity impact likely reflects the ability to POST to internal write endpoints or to leverage stolen credentials, rather than direct code integrity loss.

An authenticated Flowise user (or an attacker holding a valid API key) creates a Custom Function node whose JavaScript imports the built-in http module and requests http://169.254.169.254/latest/meta-data/iam/security-credentials/, which the axios/node-fetch deny list never inspects. On a Flowise instance running on AWS EC2 with an attached IAM role, this returns temporary cloud credentials that the attacker exfiltrates for lateral movement. A proof-of-concept demonstrating exactly this flow is published in the GitHub advisory.