Executive brief
Flowise is an open-source low-code platform for building AI agents and workflows. An SSRF vulnerability in the Execute Flow node allows authenticated attackers to bypass security controls and make HTTP requests to internal network addresses, cloud metadata services, and private systems. This could lead to exposure of sensitive internal configuration, credentials, and enable reconnaissance of internal infrastructure.
Technical details
The vulnerability is a server-side request forgery (SSRF, CWE-918) in the Execute Flow node of Flowise. The vulnerable component (httpSecurity.ts) fails to invoke secureFetch validation when processing the base URL field, allowing attackers to bypass the checkDenyList and resolveAndValidate security checks. The attack requires low privileges (an authenticated user account) and network access to the Flowise API. An attacker can craft a POST request to /api/v1/prediction with an intranet address in the base URL field to trigger HTTP requests to internal systems, read cloud metadata, or enumerate internal services. The vulnerability was patched in version 3.1.0.
Affected products
- Flowise Flowise < 3.1.0
- Flowise flowise-components < 3.1.0
Timeline
- 2026-04-15: disclosed: Original advisory GHSA-9hrv-gvrv-6gf2 published
- 2026-06-23: disclosed: Duplicate advisory GHSA-w4hm-rrxg-pxcf published
- 2026-06-23: patched: Fix released in version 3.1.0
- 2026-09-23: other: Duplicate advisory withdrawn