EUVD-2026-25289
GHSA-2x8m-83vc-6wv4
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Default-insecure path is trivial (AC:L) for an authenticated flow builder (PR:L); SSRF chiefly yields internal-data disclosure (C:H) with limited integrity and no direct availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
6DescriptionGitHub Advisory
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list. This vulnerability is fixed in 3.1.0.
AnalysisAI
Server-Side Request Forgery protection bypass in FlowiseAI Flowise (and the flowise-components package) before 3.1.0 lets low-privileged authenticated users reach internal and localhost services despite the built-in secureAxiosRequest/secureFetch wrappers. The wrappers fail open when HTTP_DENY_LIST is unset (the default), so no deny list is enforced at all, and even when configured they are defeatable via DNS rebinding (TOCTOU) between the validation lookup and the connection lookup. A vendor advisory (GHSA-2x8m-83vc-6wv4) and proof-of-concept confirm the flaw; publicly available exploit code exists, though EPSS is very low (0.04%) and it is not in CISA KEV.
Technical ContextAI
Flowise is an open-source, low-code drag-and-drop builder for LLM/agent workflows; its node components (HTTP request nodes, document loaders, tool calls) make outbound requests through centralized safety wrappers in packages/components/src/httpSecurity.ts. Those wrappers are the intended SSRF control (CWE-918: Server-Side Request Forgery). Two root causes exist: (1) a fail-open default - checkDenyList returns immediately when process.env.HTTP_DENY_LIST is undefined, permitting all destinations including 127.0.0.1; and (2) a classic time-of-check/time-of-use gap - the wrapper resolves the hostname once via dns.lookup to validate the IP, but the underlying HTTP client performs its own second DNS resolution to connect, allowing a low-TTL attacker-controlled domain to return a safe IP during validation and an internal IP (e.g., 127.0.0.1) during the actual fetch. Affected CPEs are cpe:2.3:a:flowiseai:flowise:*:*:* and cpe:2.3:a:flowiseai:flowise-components:*:*:*.
RemediationAI
Vendor-released patch: upgrade Flowise and flowise-components to 3.1.0 or later, which corrects the httpSecurity.ts logic (per GHSA-2x8m-83vc-6wv4: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2x8m-83vc-6wv4). Until upgrading, explicitly set the HTTP_DENY_LIST environment variable to enforce a deny list rather than relying on the fail-open default - include loopback and internal ranges (127.0.0.0/8, 0.0.0.0, 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16); note this closes the default-insecure hole but does NOT stop DNS rebinding, so it is only a partial control. To blunt the TOCTOU path, place Flowise behind an egress firewall or forward proxy that restricts outbound destinations to an allow-list of known-good hosts (trade-off: may break legitimate external integrations and requires maintenance), and block metadata/link-local and RFC1918 destinations at the network layer. Also restrict who can create or edit flows, since exploitation requires an authenticated builder (PR:L); this reduces exposure in shared instances but does not help against a malicious authenticated user.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Privilege escalation in Flowise versions prior to 3.0.13 allows authenticated users to bypass API authorization by spoof
Flowise versions up to 3.0.13 is affected by authorization bypass through user-controlled key (CVSS 8.8).
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today