Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems. By injecting malicious prompt templates, attackers can bypass the intended API documentation constraints and redirect requests to sensitive internal services, potentially leading to internal network reconnaissance and data exfiltration. This vulnerability is fixed in 3.1.0.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6r77-hqx7-7vw8 Exploit, Vendor Advisory
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6r77-hqx7-7vw8 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.3 · flowiseaiNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*
References 2
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6r77-hqx7-7vw8 Exploit, Vendor Advisory
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6r77-hqx7-7vw8 Exploit, Vendor Advisory