Securaity Browse advisories
SA-26-199 High

Flowise: Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow…

Flowise

More for Flowise RSS feed for Flowise

Severity
High, CVSS 7.1
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Record
CVE-2026-56275
Affects
Flowise
Known exploited
Not listed in the CISA Known Exploited Vulnerabilities catalog
Published
Record first published by the source
June 23, 2026
Source last modified
October 25, 2026

Description

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud metadata, and enumerate internal services by exploiting the missing secureFetch verification in httpSecurity.ts.

Description quoted from the NVD record.

Who is affected

Your organization is affected if it runs Flowise, a tool for building apps that use AI language models, at any version before 3.1.0. The problem is in the Execute Flow building block used in workflows. An attacker can enter an address on your internal network in its base address field and get past the security check. The Flowise server can then be made to send web requests to computers inside your network, reach information that cloud hosting services keep about the server, and map out internal services. This flaw is rated High.

What to do

  1. The person who installed or runs Flowise for your organization should handle this. Ask them which version of Flowise is in use.
  2. If the version is earlier than 3.1.0, have them update Flowise to version 3.1.0 or later, which fixes this flaw.
  3. If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update will be done.
  4. After the update, ask the person who made it to check that Flowise now shows version 3.1.0 or later.

Analysis written from the source record as of October 25, 2026 and reviewed before publishing.

Sources

MORE ADVISORIES

See all