Executive brief
Flowise is an open-source tool used to build customized LLM (Large Language Model) orchestration flows. A vulnerability in the 'Execute Flow' component allows an attacker with low-level access to force the server to make unauthorized requests to internal network addresses. This could lead to the exposure of sensitive internal data, cloud metadata, or the discovery of private services that are not intended to be reachable from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Flowise (and flowise-components) versions up to 3.0.13. The 'Execute Flow' node fails to properly invoke security validation checks (specifically 'checkDenyList' and 'resolveAndValidate' in httpSecurity.ts) when processing the 'base url' field. An authenticated attacker with network access can provide an internal IP address or hostname, causing the server to initiate HTTP requests to the intranet. This can be used to probe internal services, read cloud instance metadata, or access sensitive management interfaces. The issue is resolved in version 3.1.0 by implementing 'secureFetch' for request verification.
Affected products
- FlowiseAI flowise <= 3.0.13
- FlowiseAI flowise-components <= 3.0.13
Timeline
- 2026-04-15: disclosed: Vulnerability reported to FlowiseAI
- 2026-04-16: advisory: GitHub Advisory GHSA-9hrv-gvrv-6gf2 published
- 2026-04-16: patched: Fixed in version 3.1.0