Flowise: Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 7.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Record
- CVE-2026-67620
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 8, 2026
- Source last modified
- October 24, 2026
Description
Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticated attackers to force the server to issue arbitrary GET requests to cloud instance metadata services. Attackers can send requests to the fetch-links API endpoint with a crafted URL parameter, bypassing deny-list validation including redirect-based bypasses, to reach instance metadata services and expose instance identity data and role credentials on Oracle Cloud Infrastructure or Alibaba Cloud deployments, with unauthenticated access possible when URL-fetching nodes exist in public chatflows.
Description quoted from the NVD record.
Who is affected
Flowise, a tool for building apps that use AI language models, has a flaw in versions up to and including 3.1.4. A safety check meant to stop the Flowise server from contacting private internal addresses misses the internal information services used by Oracle Cloud Infrastructure and Alibaba Cloud. On those clouds, a logged-in attacker can use the feature that fetches web links to make the server reach these services and reveal the server's identity details and its cloud access credentials. No login is needed if a public chat flow contains a building block that fetches web addresses. This flaw is rated High.
What to do
- The person who installed or runs Flowise for your organization should check which version is in use and whether it runs on Oracle Cloud Infrastructure or Alibaba Cloud.
- If the version is
3.1.4or earlier, an update is needed. No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and install it as soon as it is available. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.