EUVD-2026-38435
GHSA-w4hm-rrxg-pxcf
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via HTTP API; AC:H reflects internal topology knowledge required; PR:L for mandatory workflow-editor authentication; C:H for cloud metadata credential exposure risk.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud metadata, and enumerate internal services by exploiting the missing secureFetch verification in httpSecurity.ts.
AnalysisAI
Server-side request forgery in Flowise's Execute Flow node allows authenticated low-privilege users to coerce the server into issuing HTTP requests to arbitrary internal network addresses by supplying intranet URLs through the base URL configuration field. All flowise and flowise-components npm versions through 3.0.13 are affected due to the Execute Flow code path never invoking the secureFetch wrapper present in httpSecurity.ts. Publicly available exploit code exists in GHSA-9hrv-gvrv-6gf2, including a concrete POST request demonstrating server-side retrieval and echo of internal service responses; no CISA KEV listing indicates active mass exploitation at time of analysis.
Technical ContextAI
Flowise is an open-source Node.js LLM orchestration platform (npm packages flowise and flowise-components) used to visually build AI agent workflows. Its Execute Flow node accepts a user-configurable base URL that directs the server to make outbound HTTP calls as part of workflow execution. Other HTTP-initiating features route through checkDenyList and resolveAndValidate in httpSecurity.ts, which block RFC-1918 private ranges and cloud metadata endpoints (e.g., 169.254.169.254). The Execute Flow node bypasses this secureFetch gating entirely, leaving no validation on the destination address. CWE-918 (Server-Side Request Forgery) precisely describes this root cause: user-controlled URL input that the server resolves without restriction, enabling the application server to act as a proxy into otherwise unreachable network segments. The CPE cpe:2.3:a:flowise:flowise covers all Flowise releases up to and including 3.0.13.
RemediationAI
Vendor-released patch: upgrade both flowise and flowise-components to version 3.1.0 or later, which adds the missing secureFetch call to the Execute Flow node's HTTP request path, aligning it with the existing httpSecurity.ts protections applied to other nodes (per GHSA-9hrv-gvrv-6gf2 at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9hrv-gvrv-6gf2). If immediate upgrade is blocked, restrict Flowise workflow-editing access to explicitly trusted internal users, eliminating the low-privilege external attack surface - note this does not protect against insider misuse. For cloud-hosted deployments on AWS, enabling IMDSv2 (requiring session-oriented PUT-based token requests) prevents credential harvesting via the metadata endpoint even if SSRF remains exploitable, though internal service enumeration is still possible. Blocking outbound TCP from the Flowise server process to RFC-1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the link-local range (169.254.0.0/16) at the host or network firewall layer is the strongest compensating control but may break legitimate intranet workflow integrations and requires testing before deployment.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today