What is the CVSS score of CVE-2026-41270?

CVE-2026-41270 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Flowise are affected by CVE-2026-41270?

FlowiseAI Flowise before version 3.1.0 contains a Server-Side Request Forgery vulnerability in its Custom Function feature that allows authenticated users to bypass network protections and access…. A patch is available.

How to fix or mitigate CVE-2026-41270?

Within 24 hours, identify all deployments of Flowise and inventory instances running versions prior to 3.1.0, prioritizing production and systems with access to cloud metadata services. Within 7 days, upgrade all affected instances to Flowise 3.1.0 or later, completing production upgrades first. Within 30 days, audit access logs for the Custom Function feature over the prior 90 days, searching for suspicious HTTP requests to internal IP ranges (169.254.169.254, 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12) and credential-related endpoints, and review IAM credential access patterns for anomalies.

Flowise CVE-2026-41270

EUVD-2026-25287 HIGH

Improper Access Control (CWE-284)

2026-04-23 GitHub_M

GHSA-xhmj-rg95-44hv

Authentication Bypass SSRF Node.js Flowise Flowise Components Flowiseai

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

5.9 MEDIUM

Authenticated user needs Custom Function access (PR:L) and a reachable internal target (AC:H); primary impact is confidentiality (C:H) with limited integrity via internal writes, no availability loss.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:32 vuln.today

Analysis Generated

Jul 24, 2026 - 04:32 vuln.today

Patch released

Apr 25, 2026 - 02:16 nvd

Patch available

Apr 23, 2026 - 21:01 EUVD

EUVD ID Assigned

Apr 23, 2026 - 20:00 euvd

EUVD-2026-25287

CVE Published

Apr 23, 2026 - 19:15 nvd

HIGH 7.1

DescriptionGitHub Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and node-fetch libraries, the built-in Node.js http, https, and net modules are allowed in the NodeVM sandbox without equivalent protection. This allows authenticated users to bypass SSRF controls and access internal network resources (e.g., cloud provider metadata services) This vulnerability is fixed in 3.1.0.

AnalysisAI

Server-Side Request Forgery in FlowiseAI Flowise before 3.1.0 lets authenticated users abuse the Custom Function feature to reach internal network resources such as cloud metadata endpoints. The application's HTTP_DENY_LIST only wraps the axios and node-fetch libraries, so attacker-supplied JavaScript that imports the native Node.js http, https, or net modules sidesteps SSRF controls entirely. Publicly available exploit code exists (SSVC: PoC) with a demonstrated AWS EC2 IAM-credential theft path, though EPSS remains very low at 0.04%.

Technical ContextAI

Flowise is a low-code, drag-and-drop builder for LLM orchestration flows written in Node.js. Its Custom Function node executes user-supplied JavaScript inside a NodeVM sandbox (vm2-style) configured in packages/components/src/utils.ts. SSRF hardening is implemented in packages/components/src/httpSecurity.ts via a checkDenyList() function, but that check is only bound to mocked wrappers for axios and node-fetch injected through the sandbox's require.mock option. The sandbox's require.builtin allowlist (defaultAllowBuiltInDep) simultaneously grants direct access to the native http, https, net, dns, and dgram modules with no equivalent filtering. This maps to CWE-284 (Improper Access Control): a security control exists but is applied to an incomplete set of code paths, leaving a functionally equivalent primitive unguarded.

RemediationAI

Vendor-released patch: 3.1.0 - upgrade both the flowise and flowise-components npm packages to 3.1.0 or later, which extends SSRF protection to the native modules (see GHSA-xhmj-rg95-44hv). Until upgrading, restrict who can create or edit Custom Function nodes: treat Custom Function code execution as an administrative privilege and remove it from lower-trust accounts, since HTTP_DENY_LIST alone does not stop the http/https/net bypass. As network-level compensating controls, run the Flowise instance where it cannot reach sensitive internal endpoints - on AWS enforce IMDSv2 and set the metadata hop limit to 1 (blocks the 169.254.169.254 credential-theft path; side effect: applications relying on IMDSv1 break), and apply egress firewall rules or a NAT/security-group policy denying outbound traffic to link-local and internal RFC1918 ranges (side effect: legitimate internal integrations from flows will also be blocked). Rotate any IAM role or instance credentials if exposure is suspected. Advisory URLs: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhmj-rg95-44hv and https://vuldb.com/vuln/359211.