Executive brief
Flowise, an open-source tool for building AI workflows, contains a vulnerability in its HTTP Node component. This flaw allows an attacker to force the server to make unauthorized requests to internal systems, such as private company dashboards, cloud metadata services, or internal databases. This could lead to the theft of sensitive credentials or the modification of internal data, potentially compromising the entire corporate network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Flowise HTTP Node within AgentFlow and Chatflow. The component fails to restrict target hosts, allowing user-controlled URLs to point to private IP ranges (RFC 1918), localhost, or cloud metadata endpoints (e.g., AWS IMDS). An attacker with low privileges can utilize various HTTP methods (GET, POST, PUT, DELETE) to perform port scanning, retrieve sensitive internal data, or modify internal resources. The vulnerability is exacerbated by the fact that Flowise instances are often deployed without default authentication. The issue is addressed in version 3.0.13.
Affected products
- FlowiseAI flowise <= 3.0.12
- FlowiseAI flowise-components <= 3.0.12
Timeline
- 2026-03-10: disclosed: NVD publication date
- 2026-03-11: advisory: GitHub Advisory published
- 2026-03-11: patched: Fix released in version 3.0.13