CVE-2026-41272: Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)

CVE-2026-41272 · Severity: high · CVSS 7.1 · Published 2026-04-23

Flowise is a visual AI agent builder that makes HTTP requests to external services. The application's security controls meant to prevent malicious requests to internal systems are broken in two ways: they fail by default when not configured, and they can be bypassed via DNS tricks that swap IP addresses between validation and actual connection. An attacker with network-level influence can reach internal systems that should be protected.

Technologies: FlowiseAI Flowise, flowise (npm), flowise-components (npm). Vendors: FlowiseAI, npm.

Quick answers

Is CVE-2026-41272 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41272 being exploited in the wild.
How severe is CVE-2026-41272?
High severity, with a CVSS score of 7.1, published 23 April 2026.
Which products and versions are affected?
flowise (npm) <= 3.0.13, SEMVER:introduced=0,fixed=3.1.0; flowise-components (npm) <= 3.0.13, SEMVER:introduced=0,fixed=3.1.0.
Is there a fix for CVE-2026-41272?
Yes. flowise (npm): upgrade to 3.1.0 or later; flowise-components (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41272 attacked?
It is attacked over the network.
Am I affected by CVE-2026-41272?
Check whether you run FlowiseAI Flowise, flowise (npm) or flowise-components (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • flowise (npm): upgrade to 3.1.0 or later
    npm install flowise@3.1.0
  • flowise-components (npm): upgrade to 3.1.0 or later
    npm install flowise-components@3.1.0

Technical details

The vulnerability exists in the secureAxiosRequest and secureFetch wrapper functions in packages/components/src/httpSecurity.ts. Two distinct flaws undermine SSRF protection: (1) Default Insecure—when the HTTP_DENY_LIST environment variable is undefined, the checkDenyList function returns early without blocking any addresses, allowing requests to localhost and other internal addresses; (2) TOCTOU (Time-of-Check Time-of-Use)—the code performs a DNS lookup to validate the destination IP address, but the HTTP client performs a separate DNS lookup when actually connecting. An attacker controlling authoritative DNS can return a safe IP (e.g., 1.1.1.1 with TTL=0) during validation, then return an internal IP (e.g., 127.0.0.1) for the subsequent connection, bypassing the check. Both attacks require the attacker to be on the network or control DNS; the TOCTOU variant has medium complexity. An authenticated attacker can invoke HTTP requests through Flowise nodes to access internal services, potentially reading sensitive data. Patch available in version 3.1.0 for both flowise and flowise-components packages.

Affected products

  • FlowiseAI flowise <= 3.0.13
  • FlowiseAI flowise-components <= 3.0.13

Identifiers

  • CVE-2026-41272
  • GHSA-2x8m-83vc-6wv4

Timeline

  • 2026-04-16: disclosed: Advisory GHSA-2x8m-83vc-6wv4 published
  • 2026-04-16: patched: Fixed in versions flowise 3.1.0 and flowise-components 3.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.