# CVE-2026-67620: Flowise server-side request forgery in metadata service guard

Source: https://junglewise.ai/threats/cve-2026-67620-flowise-server-side-request-forgery-in-metadata-service-guard  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67620 · Severity: high · CVSS 7.7 · Published 2026-08-08

Flowise is a visual AI application builder that allows users to design workflows with LLM agents. A flaw in its SSRF protection allows authenticated users to bypass the metadata endpoint deny-list and force the server to retrieve cloud instance credentials from Oracle Cloud Infrastructure or Alibaba Cloud metadata services. An attacker with authentication credentials could steal instance identity data and role credentials, potentially compromising cloud infrastructure.

## Quick answers

**Is CVE-2026-67620 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67620 being exploited in the wild.

**How severe is CVE-2026-67620?** High severity, with a CVSS score of 7.7, published 8 August 2026.

**Which products and versions are affected?** Flowise Flowise through 3.1.4.

**Is there a fix for CVE-2026-67620?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67620 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-67620?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Flowise implements an SSRF guard in httpSecurity.ts with a DEFAULT_DENY_LIST to block requests to cloud metadata services. However, the deny-list is incomplete: it covers the 169.254.0.0/16 link-local range used by AWS, GCP, Azure, and DigitalOcean, but omits the Oracle Cloud metadata endpoint 192.0.0.192 and the Alibaba Cloud endpoint 100.100.100.200. An authenticated attacker can send crafted requests to the fetch-links API endpoint with a URL parameter pointing to these unblocked metadata addresses, bypassing deny-list validation and reaching instance metadata services. The vulnerability also permits unauthenticated exploitation if URL-fetching nodes exist in public chatflows. Successful exploitation allows retrieval of instance identity data and role credentials. The Flowise project has been sunset and will not issue patches; operators must implement manual mitigations.

## Affected products

- Flowise Flowise through 3.1.4

## Timeline

- 2026-08-08: disclosed
- 2026-07-10: other: Vulnerability discovered
- 2026-07-15: other: Reported to VulnCheck CVD
- 2026-07-29: other: Flowise project sunset announcement

## References

- [https://flowiseai.com/sunset](https://flowiseai.com/sunset)
- [https://github.com/abdugafforov-bobur/CVE-2026-67620-poc](https://github.com/abdugafforov-bobur/CVE-2026-67620-poc)