Home

Description

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud metadata, and enumerate internal services by exploiting the missing secureFetch verification in httpSecurity.ts.

PUBLISHED Reserved 2026-06-20 | Published 2026-06-23 | Updated 2026-06-23 | Assigner VulnCheck




MEDIUM: 6.0CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Problem types

Server-Side Request Forgery (SSRF)

Product status

Default status
unaffected

Any version before 3.1.0
affected

3.1.0 (semver)
unaffected

Default status
unaffected

Any version before 3.1.0
affected

3.1.0 (semver)
unaffected

Credits

cn-panda reporter

References

github.com/...lowise/security/advisories/GHSA-9hrv-gvrv-6gf2 (GitHub Security Advisory (GHSA-9hrv-gvrv-6gf2)) vendor-advisory

www.vulncheck.com/...quest-forgery-via-execute-flow-base-url (VulnCheck Advisory: Flowise - Server-Side Request Forgery via Execute Flow Base URL) third-party-advisory

cve.org (CVE-2026-56275)

nvd.nist.gov (CVE-2026-56275)

Download JSON