Executive brief
Flowise is an open-source low-code workflow automation platform. A server-side request forgery (SSRF) vulnerability in the Execute Flow node allows authenticated attackers to bypass security checks and make HTTP requests to internal network addresses, cloud metadata services, or other restricted resources by manipulating the base URL field. This could enable attackers to discover internal services, access sensitive management interfaces, and leak confidential configuration or credentials.
Technical details
The Execute Flow node in Flowise before 3.1.0 contains a server-side request forgery (CWE-918) vulnerability in httpSecurity.ts. The vulnerable component fails to call the secureFetch verification function when processing intranet addresses provided through the base URL field, bypassing the checkDenyList and resolveAndValidate security checks. Exploitation requires authentication (API key or bearer token), network access to the Flowise API endpoint, and the ability to configure or trigger an Execute Flow node with a malicious base URL. A successful attack enables arbitrary HTTP requests from the server to internal networks, cloud metadata endpoints, or internal services for reconnaissance and lateral movement. The vulnerability was fixed in version 3.1.0.
Affected products
- Flowise Flowise < 3.1.0
Timeline
- 2026-06-23: disclosed: Original advisory published (GHSA-w4hm-rrxg-pxcf)
- 2026: patched: Fixed in version 3.1.0
- 2026-09-23: other: Advisory withdrawn as duplicate of GHSA-9hrv-gvrv-6gf2