Executive brief
FlowIntel, a platform used for managing security cases and intelligence, contains a vulnerability in how it handles external web links. An attacker can provide a malicious link that forces the FlowIntel server to connect to internal systems or cloud management services that are normally hidden from the public internet. This could allow an unauthorized user to probe internal network infrastructure or access sensitive configuration data from the server's environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in FlowIntel versions up to 3.3.0 within the external reference URL probe functionality located in `app/case/task.py`. The application fails to sufficiently validate URL schemes and resolved destination addresses when processing user-submitted external reference URLs. An authenticated attacker can exploit this by submitting a crafted URL, causing the server to issue an HTTP HEAD request to restricted network resources such as loopback (127.0.0.1), private IP ranges, or cloud metadata endpoints (e.g., 169.254.169.254). This can be used to map internal services or exfiltrate sensitive environment data. A patch has been identified in the project's version control system.
Affected products
- FlowIntel FlowIntel up to version 3.3.0
Timeline
- 2026-05-28: advisory: CVE-2026-9813 published by CIRCL/NVD
- 2026-05-28: patched: Fix committed to GitHub repository