CVE-2026-41271: Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

CVE-2026-41271 · Severity: high · CVSS 8.3 · Published 2026-04-23

Flowise is an open-source visual flow builder for AI applications that allows users to create chatflows with various components, including API chain integrations. An unauthenticated attacker can exploit a Server-Side Request Forgery (SSRF) vulnerability in the APIChain component by injecting malicious prompts that trick the system into making arbitrary HTTP requests to internal or external services. This could allow attackers to scan internal networks, access cloud metadata endpoints containing credentials, or exfiltrate sensitive data from internal systems.

Technologies: FlowiseAI Flowise, flowise (npm), flowise-components (npm). Vendors: FlowiseAI, npm.

Quick answers

Is CVE-2026-41271 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41271 being exploited in the wild.
How severe is CVE-2026-41271?
High severity, with a CVSS score of 8.3, published 23 April 2026.
Which products and versions are affected?
flowise (npm) <= 3.0.13, SEMVER:introduced=0,fixed=3.1.0; flowise-components (npm) <= 3.0.13, SEMVER:introduced=0,fixed=3.1.0.
Is there a fix for CVE-2026-41271?
Yes. flowise (npm): upgrade to 3.1.0 or later; flowise-components (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41271 attacked?
It is attacked over the network.
Am I affected by CVE-2026-41271?
Check whether you run FlowiseAI Flowise, flowise (npm) or flowise-components (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • flowise (npm): upgrade to 3.1.0 or later
    npm install flowise@3.1.0
  • flowise-components (npm): upgrade to 3.1.0 or later
    npm install flowise-components@3.1.0

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) flaw in Flowise's APIChain implementation (CWE-918) where user-controlled prompt input is used to generate HTTP requests without proper URL validation. The vulnerable code in postCore.ts extracts URL and data parameters directly from LLM-generated responses based on user-provided API documentation, then passes these to fetch() without checking if the URL matches the intended API endpoint. An unauthenticated attacker can inject malicious prompt templates that override the API documentation with a fake BASE URL pointing to internal services (e.g., http://host.docker.internal:8080), causing the Flowise server to make requests to arbitrary endpoints. The LLM-based API chain trusts its own output implicitly, enabling the attacker to bypass network segmentation and firewall rules by pivoting through the Flowise server. Patches are available in versions 3.1.0 and later (flowise npm package ≤ 3.0.13 affected; flowise-components npm package ≤ 3.0.13 affected).

Affected products

  • FlowiseAI Flowise <=3.0.13

Identifiers

  • CVE-2026-41271
  • GHSA-6r77-hqx7-7vw8

Timeline

  • 2026-04-16: disclosed
  • 2026-04-16: patched: Version 3.1.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.