What is the CVSS score of EUVD-2026-25288?

EUVD-2026-25288 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Flowise are affected by EUVD-2026-25288?

Flowise versions prior to 3.1.0 contain a Server-Side Request Forgery (SSRF) vulnerability allowing unauthenticated attackers to coerce your server into making arbitrary HTTP requests to internal…. A patch is available.

How to fix or mitigate EUVD-2026-25288?

Within 24 hours, inventory all Flowise deployments and identify instances running versions prior to 3.1.0, prioritizing production systems and those with cloud connectivity. Within 7 days, upgrade all vulnerable instances to Flowise 3.1.0 or later, testing the upgrade in a staging environment before production rollout to ensure API chain functionality remains intact. Within 30 days, review Flowise API access logs for suspicious or unexpected HTTP requests to internal IP ranges or cloud metadata services, implement network egress controls to restrict server outbound requests to only necessary endpoints, and establish continuous monitoring alerts for anomalous request patterns from Flowise components.

Flowise EUVD-2026-25288

| CVE-2026-41271 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-23 GitHub_M

GHSA-6r77-hqx7-7vw8

SSRF Flowise Flowise Components

8.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

7.1 HIGH

Network-reachable API Chain with low privileges and no UI; SSRF chiefly enables internal reads (C:H) with limited request-forgery integrity impact (I:L) and no meaningful availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:29 vuln.today

Analysis Generated

Jul 24, 2026 - 04:29 vuln.today

CVSS changed

Apr 24, 2026 - 16:52 NVD

7.1 (HIGH) 8.3 (HIGH)

Patch released

Apr 24, 2026 - 16:37 nvd

Patch available

Apr 23, 2026 - 21:01 EUVD

EUVD ID Assigned

Apr 23, 2026 - 20:00 euvd

EUVD-2026-25288

CVE Published

Apr 23, 2026 - 19:17 nvd

HIGH 8.3

DescriptionGitHub Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems. By injecting malicious prompt templates, attackers can bypass the intended API documentation constraints and redirect requests to sensitive internal services, potentially leading to internal network reconnaissance and data exfiltration. This vulnerability is fixed in 3.1.0.

AnalysisAI

Server-Side Request Forgery in Flowise's GET/POST API Chain components (versions prior to 3.1.0) lets unauthenticated remote attackers coerce the server into issuing arbitrary HTTP requests to internal and external hosts. Because the chain trusts LLM-generated URLs derived from user-supplied API documentation, an attacker injects a fake documentation prompt that overrides the intended BASE URL, enabling internal reconnaissance, cloud-metadata access, and data exfiltration. Publicly available exploit code exists (SSVC exploitation: poc), but EPSS is very low (0.05%) and the flaw is not in CISA KEV, so no active exploitation is confirmed.

Technical ContextAI

Flowise is a low-code, drag-and-drop builder for LLM application flows (chatbots, agents, RAG pipelines) built on LangChain-style chains. The defect lives in the API Chain node (packages/components/nodes/chains/ApiChain/postCore.ts and its GET counterpart), which prompts an LLM with a user query plus API documentation and expects back a JSON {url, data} object that it passes directly to fetch(). This is a classic CWE-918 (Server-Side Request Forgery): the constructed request target is derived from untrusted, prompt-injectable input and is never validated against an allowlist or the legitimate base URL. Because the LLM-supplied documentation can itself be attacker-controlled, the model can be steered to emit URLs such as http://host.docker.internal:8080/flag or cloud metadata endpoints (e.g., 169.254.169.254), and the server dutifully connects. The affected CPEs are cpe:2.3:a:flowiseai:flowise and cpe:2.3:a:flowiseai:flowise-components.

RemediationAI

Vendor-released patch: upgrade to Flowise 3.1.0 (and flowise-components 3.1.0), which fixes the issue per GHSA-6r77-hqx7-7vw8. Until you can upgrade, avoid using the GET/POST API Chain nodes in production flows, or restrict their use to trusted, authenticated operators only, since the URL is derived from prompt-injectable input. As compensating controls, place the Flowise server behind egress network controls: block outbound access from the Flowise container to internal RFC1918 ranges, link-local metadata (169.254.169.254), and host.docker.internal, allowing only the specific external API hosts your flows legitimately call - the trade-off is that legitimate API Chain destinations must be explicitly allowlisted. Additionally, run Flowise with IMDSv2 enforced on cloud instances to blunt metadata theft, and put authentication/network ACLs in front of the Flowise application so the chain endpoints are not exposed to untrusted callers. See the advisory at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6r77-hqx7-7vw8 for details.