Flowise CVE-2026-67620

Exploitation requires that Flowise be deployed on Oracle Cloud Infrastructure or Alibaba Cloud - the vulnerability is only impactful against these two providers whose metadata IPs are absent from the deny-list (192.0.0.192 for OCI, 100.100.100.200 for Alibaba). In the standard deployment model, the attacker must hold a valid Flowise account (PR:L per the CVSS 4.0 vector) to call the fetch-links API endpoint. However, unauthenticated exploitation is explicitly possible when URL-fetching nodes are present in public chatflows, removing the authentication requirement entirely in that configuration. Redirect-based bypass techniques are also viable, meaning simple IP-level deny-list patches that do not also harden redirect-following behavior remain exploitable. Deployments on AWS, Azure, or GCP are not affected by these specific missing entries.

The CVSS 4.0 base score of 6.3 reflects standard authenticated SSRF impact, but real-world risk is significantly higher for cloud-hosted deployments. The SC:H metric correctly captures the downstream consequence: exfiltrated OCI or Alibaba Cloud instance credentials can enable lateral movement, privilege escalation, or full cloud tenant compromise - impacts far exceeding what the base score implies in isolation. No EPSS data was provided, limiting probabilistic exploitation forecasting. The existence of a public POC (GitHub) meaningfully increases exploitation likelihood beyond what an unpublished SSRF would represent. Crucially, the description states that unauthenticated exploitation is possible when URL-fetching nodes are exposed in public chatflows, which relaxes the PR:L baseline assumption in environments using that feature. The vendor's primary domain now resolves to a sunset page (flowiseai.com/sunset), strongly suggesting the product is discontinued and no vendor-issued patch will follow - organizations relying on this software should treat this as an unmitigated vulnerability with no official remediation path. Risk is scoped exclusively to deployments on OCI or Alibaba Cloud; deployments on AWS, Azure, or GCP are not affected by these specific missing deny-list entries, though other gaps may exist.

An authenticated user on a Flowise instance hosted on Oracle Cloud Infrastructure submits a POST request to the fetch-links API endpoint with the URL parameter set to http://192.0.0.192/latest/meta-data/iam/security-credentials/. The SSRF guard checks the IP against the DEFAULT_DENY_LIST, finds no match, and the server issues the GET request on behalf of the attacker. The OCI metadata service responds with instance IAM role credentials, which the attacker uses to authenticate to the OCI API and escalate privileges within the cloud tenancy. A public POC is available, lowering the skill bar for this attack.