Iniciar sesión
Deutsch English Español Polski
Media

Flowise Execute Flow function has an SSRF vulnerability

  • Publicada: 16.04.2026
  • Actualizado: 11.10.2026 10:22

Summary

The attacker provides an intranet address through the base url field configured in the Execute Flow node → Bypass checkDenyList / resolveAndValidate in httpSecurity.ts (not called) → Causes the server to initiate an HTTP request to any internal network address, read cloud metadata, or detect internal network services

Details

<img width="1280" height="860" alt="9a52a74e6fe2fd78e4962d1d68057fc2" src="https://github.com/user-attachments/assets/20df0006-9129-4886-8928-16d19a617c23" />

Then initiate the call:

POST /api/v1/prediction/d6739838-d3b3-43d9-86ff-911a3d757a7e HTTP/1.1
Host: 127.0.0.1:3000
Content-Type: application/json
Authorization: Bearer apikey
Content-Length: 17

{"question": "1"}

Server received a request:

<img width="1432" height="172" alt="f45c757fec408e13739db068252ff21b" src="https://github.com/user-attachments/assets/d3dfe0f5-83ec-4c79-ab32-754382a68d5f" />

And there is an echo:

<img width="1280" height="666" alt="fa0caf0deb306cfeeea8fdf8941a287e" src="https://github.com/user-attachments/assets/55a94d25-120b-4e9c-9517-46c2fc2b667f" />

Fix: Call secureFetch for verification

Impact

This is a Server-Side Request Forgery (SSRF) vulnerability that may lead to the following risks:

  • Explore Internal Web Applications
  • Access sensitive management interfaces
  • Leak internal configuration, credentials, or confidential information

This vulnerability significantly increases the risk of internal service enumeration and potential lateral movement in enterprise environments.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de npm flowise < 3.1.0 3.1.0
Paquete de npm flowise-components < 3.1.0 3.1.0

Referencias

Puntuación CVSS 7.1/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Debilidad (CWE)
CWE-918
Plataforma
npm
Paquete
flowise, flowise-components
Publicada
16.04.2026
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-9hrv-gvrv-6gf2 - CC BY 4.0

Historial de vulnerabilidades: flowise

Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (114) en el archivo
Entradas en total
114
Primera → última
04.2024 10.2026
Sin corrección
16
Explotada en ataques
0

Distribución por gravedad

  • Crítica 28
  • Alta 62
  • Media 24

Divulgaciones por año

Gravedad:
  1. Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
    Crítica CVE-2026-73487 < 3.1.3 3.1.3
  2. Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
    Crítica CVE-2026-73483 < 3.1.3 3.1.3
  3. Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
    Crítica CVE-2026-70478 < 3.1.3 3.1.3
  4. Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
    Crítica CVE-2026-70477 < 3.1.3 3.1.3
  5. Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
    Alta CVE-2026-70476 < 3.1.3 3.1.3
  6. Flowise: Missing Authorization on Execution Update Endpoint
    Alta CVE-2026-70475 < 3.1.3 3.1.3
  7. Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
    Alta CVE-2026-70474 < 3.1.3 3.1.3
  8. Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
    Alta CVE-2026-70473 < 3.1.3 3.1.3
  9. Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
    Alta CVE-2026-70472 < 3.1.3 3.1.3
  10. Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
    Crítica CVE-2026-69264 < 3.1.3 3.1.3
  11. Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
    Alta ghsa-88pr-878c-24wf < 3.1.3 3.1.3
  12. Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
    Alta CVE-2026-70471 < 3.1.3 3.1.3
  13. Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
    Crítica CVE-2026-70470 < 3.1.3 3.1.3
  14. Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
    Alta CVE-2026-69263 < 3.1.3 3.1.3
  15. Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type
    Alta CVE-2026-69262 < 3.1.3 3.1.3
  16. Flowise RCE via SQLite Record Manager Node
    Crítica CVE-2026-69259 < 3.1.3 3.1.3
  17. Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API
    Alta CVE-2026-69258 < 3.1.3 3.1.3
  18. Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
    Alta CVE-2026-69257 < 3.1.3 3.1.3
  19. Flowise: Remote Code Execution Vulnerability in CSVAgent
    Crítica CVE-2026-69256 < 3.1.3 3.1.3
  20. Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
    Crítica CVE-2026-69255 < 3.1.3 3.1.3
  21. Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
    Crítica CVE-2026-69254 < 3.1.3 3.1.3
  22. Flowise Sandbox Escape to RCE
    Crítica CVE-2026-69253 < 3.1.3 3.1.3
  23. Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization
    Alta CVE-2026-69252 < 3.1.3 3.1.3
  24. Flowise RCE via TypeORM DataSource
    Crítica CVE-2026-69251 < 3.1.3 3.1.3
  25. Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration
    Alta CVE-2026-69250 < 3.1.3 3.1.3
  26. FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover
    Alta · 8.8 CVE-2026-46480 < 3.1.2 3.1.2
  27. FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover
    Alta · 8.8 CVE-2026-46479 < 3.1.2 3.1.2
  28. FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover
    Alta · 8.8 CVE-2026-46478 < 3.1.2 3.1.2
  29. FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover
    Alta · 8.8 CVE-2026-46477 < 3.1.2 3.1.2
  30. FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover
    Alta CVE-2026-46476 < 3.1.2 3.1.2
  31. FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover
    Alta · 8.8 CVE-2026-46475 < 3.1.2 3.1.2
  32. FlowiseAI: Vector Store No Permission Checks
    Alta · 8.8 CVE-2026-46444 < 3.1.2 3.1.2
  33. FlowiseAI Vulnerable to Credential Data Leak
    Alta CVE-2026-46443 < 3.1.2 3.1.2
  34. FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
    Crítica CVE-2026-46442 < 3.1.2 3.1.2
  35. FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment
    Alta CVE-2026-46441 < 3.1.2 3.1.2
  36. Flowise has an MCP Security Bypass that Enables RCE
    Alta CVE-2026-56274 < 3.1.2 3.1.2
  37. FlowiseAI Exposes Basic Auth Credentials via API
    Alta · 7.5 CVE-2026-46440 < 3.1.2 3.1.2
  38. FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment
    Alta CVE-2026-42863 < 3.1.2 3.1.2
  39. FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment
    Alta CVE-2026-42862 < 3.1.2 3.1.2
  40. FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment
    Alta CVE-2026-42861 < 3.1.2 3.1.2
  41. Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
    Crítica · 9.8 CVE-2026-41264 < 3.1.0 3.1.0
  42. Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
    Crítica · 9.8 CVE-2026-41265 < 3.1.0 3.1.0
  43. Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials
    Alta · 7.5 CVE-2026-41279 < 3.1.0 3.1.0
  44. Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs
    Alta · 7.5 CVE-2026-41278 < 3.1.0 3.1.0
  45. Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)
    Alta · 8.8 CVE-2026-41277 < 3.1.0 3.1.0
  46. Flowise: resetPassword Authentication Bypass Vulnerability
    Alta · 9.8 CVE-2026-41276 < 3.1.0 3.1.0
  47. Flowise: Cypher Injection in GraphCypherQAChain
    Alta CVE-2026-41274 < 3.1.0 3.1.0
  48. Flowise: Password Reset Link Sent Over Unsecured HTTP
    Alta · 7.5 CVE-2026-41275 < 3.1.0 3.1.0
  49. Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise
    Alta · 8.2 CVE-2026-41273 < 3.1.0 3.1.0
  50. Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
    Alta · 7.1 CVE-2026-41271 < 3.1.0 3.1.0
  51. Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
    Alta · 7.1 CVE-2026-41272 < 3.1.0 3.1.0
  52. Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
    Alta · 7.1 CVE-2026-41270 < 3.1.0 3.1.0
  53. Flowise: File Upload Validation Bypass in createAttachment
    Alta · 7.1 CVE-2026-41269 < 3.1.0 3.1.0
  54. Flowise: Parameter Override Bypass Remote Command Execution
    Alta · 7.7 CVE-2026-41268 < 3.1.0 3.1.0
  55. Flowise: Sensitive Data Leak in public-chatbotConfig
    Alta · 7.5 CVE-2026-41266 < 3.1.0 3.1.0
  56. Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association
    Alta · 8.1 CVE-2026-41267 < 3.1.0 3.1.0
  57. Flowise: Code Injection in CSVAgent leads to Authenticated RCE
    Crítica · 8.8 CVE-2026-41137 < 3.1.0 3.1.0
  58. Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
    Alta · 8.3 CVE-2026-41138 < 3.1.0 3.1.0
  59. Flowise Execute Flow function has an SSRF vulnerability esta entrada
    Media · 7.1 CVE-2026-56275 < 3.1.0 3.1.0
  60. Flowise: Authenticated RCE Via MCP Adapters
    Crítica · 9.9 CVE-2026-40933 < 3.1.0 3.1.0
  61. Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access
    Alta · 7.1 CVE-2026-31829 < 3.0.13 3.0.13
  62. Flowise Missing Authentication on NVIDIA NIM Endpoints
    Alta CVE-2026-30824 < 3.0.13 3.0.13
  63. Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
    Alta · 8.8 CVE-2026-30823 < 3.0.13 3.0.13
  64. Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint
    Alta · 7.7 CVE-2026-30822 < 3.0.13 3.0.13
  65. Flowise has Arbitrary File Upload via MIME Spoofing
    Alta CVE-2026-30821 < 3.0.13 3.0.13
  66. Flowise has Authorization Bypass via Spoofed x-request-from Header
    Alta CVE-2026-30820 < 3.0.13 3.0.13
  67. Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register)
    Alta CVE-2025-71327 = 3.0.1 sin corrección
  68. Flowise Fails to Invalidate Existing Sessions After Password Changes
    Alta · 8.1 CVE-2025-71335 < 3.0.10 3.0.10
  69. Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages
    Alta CVE-2025-34267 >= 3.0.1, < 3.0.8 3.0.8
  70. Flowise is vulnerable to arbitrary file exposure through its ReadFileTool
    Alta · 7.7 ghsa-j44m-5v8f-gc9c < 3.0.8 3.0.8
  71. Flowise is vulnerable to arbitrary file write through its WriteFileTool
    Crítica · 9.9 CVE-2025-61913 < 3.0.8, < 3.0.8 3.0.8
  72. FlowiseAI/Flosise has File Upload vulnerability
    Alta · 8.3 CVE-2025-61687 >= 3.0.7, < 3.0.8 3.0.8
  73. Flowise vulnerable to RCE via Dynamic function constructor injection
    Crítica · 9.8 CVE-2025-55346 <= 2.2.7-patch.1 sin corrección
  74. Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel
    Crítica · 9.3 CVE-2025-50538 < 3.0.8 3.0.8
  75. Flowise has unsandboxed remote code execution via Custom MCP
    Alta CVE-2025-71336 >= 2.2.7-patch.1, < 3.0.6 3.0.6
  76. Flowise has arbitrary file access due to missing chat flow id validation
    Crítica · 9.8 CVE-2025-71334 >= 2.2.8, < 3.0.6 3.0.6
  77. Flowise has an Arbitrary File Read
    Crítica · 9.1 CVE-2025-71324 >= 3.0.5, < 3.0.6 3.0.6
  78. Flowise has Remote Code Execution vulnerability
    Crítica · 10.0 CVE-2025-59528 >= 3.0.5, < 3.0.6 3.0.6
  79. FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
    Alta · 7.5 CVE-2025-59527 >= 3.0.5, < 3.0.6 3.0.6
  80. FlowiseAI Pre-Auth Arbitrary Code Execution
    Crítica · 9.1 CVE-2025-57164 >= 3.0.5, < 3.0.6 3.0.6
Mostrar más (11) Mostrando 80 de 91

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.