EUVD-2026-54793
GHSA-6h53-jfj2-fh9c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API, no complexity; PR:L reflects normal auth requirement; S:C and C:H capture credential exfiltration from the out-of-scope cloud metadata layer.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticated attackers to force the server to issue arbitrary GET requests to cloud instance metadata services. Attackers can send requests to the fetch-links API endpoint with a crafted URL parameter, bypassing deny-list validation including redirect-based bypasses, to reach instance metadata services and expose instance identity data and role credentials on Oracle Cloud Infrastructure or Alibaba Cloud deployments, with unauthenticated access possible when URL-fetching nodes exist in public chatflows.
AnalysisAI
Server-side request forgery in Flowise through 3.1.4 allows attackers to reach Oracle Cloud Infrastructure (OCI) and Alibaba Cloud instance metadata services by exploiting an incomplete deny-list in the SSRF guard (httpSecurity.ts). The DEFAULT_DENY_LIST omits the OCI metadata IP 192.0.0.192 and the Alibaba Cloud metadata IP 100.100.100.200, enabling credential theft from the cloud metadata layer. No public exploit identified at time of analysis in CISA KEV, but publicly available exploit code exists on GitHub, and the vendor's website now resolves to a sunset page, suggesting no official patch will be issued.
Technical ContextAI
Flowise is an open-source drag-and-drop LLM flow builder that exposes a fetch-links API endpoint accepting user-controlled URL parameters. Its SSRF mitigation is implemented in httpSecurity.ts via a DEFAULT_DENY_LIST intended to block access to cloud instance metadata services and internal network ranges. CWE-918 (Server-Side Request Forgery) is the root cause class: the deny-list is structurally sound but incomplete, omitting two cloud-provider-specific metadata IPs - 192.0.0.192 (Oracle Cloud Infrastructure metadata endpoint) and 100.100.100.200 (Alibaba Cloud metadata endpoint). The vulnerability is compounded by redirect-based bypass support, meaning an attacker can chain redirects to reach these endpoints even if future IP-level blocking is applied naively. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) reflects a network-reachable endpoint with no attack complexity, and the SC:H (high subsequent-system confidentiality) models the credential exfiltration from the cloud metadata layer outside Flowise's own trust boundary.
RemediationAI
No vendor-released patch has been identified at time of analysis; the product appears to have been sunset (see flowiseai.com/sunset), and no fixed version number is available from the provided data or references. The upstream fix would require adding 192.0.0.192 and 100.100.100.200 to the DEFAULT_DENY_LIST in httpSecurity.ts, along with hardened redirect-following controls; the public POC at https://github.com/abdugafforov-bobur/CVE-2026-67620-poc can be used to validate whether a self-applied patch is effective. As compensating controls: enforce outbound network egress rules on the host running Flowise to block TCP connections to 192.0.0.192 and 100.100.100.200 at the firewall or cloud security-group level - this is the most reliable mitigation and has no application-level side effects. If public chatflows with URL-fetching nodes are in use, disable or restrict access to those chatflows immediately to eliminate the unauthenticated attack surface. Organizations on OCI or Alibaba Cloud should rotate any instance credentials that may have been accessible via the metadata endpoint if prior exploitation cannot be ruled out. Migration off Flowise to an actively maintained alternative should be treated as a near-term priority given the sunset status.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTO
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today