CVE-2026-56275: Flowise SSRF Vulnerability in Execute Flow Node – Patch to 3.1.0

Technical summary

The vulnerability resides in the Execute Flow node's handling of the base URL parameter. The application fails to properly validate and sanitize user-supplied URLs against intranet address ranges before constructing HTTP requests. Specifically, the secureFetch verification in httpSecurity.ts is missing or incomplete, allowing attackers with valid authentication to inject internal IP addresses, private cloud metadata services (such as 169.254.169.254), and internal hostnames. The affected code path permits arbitrary HTTP method invocation against these internal targets, enabling service enumeration and potential data exfiltration from metadata services.

Business impact

This vulnerability enables authenticated insiders or attackers with valid Flowise credentials to map your internal network topology, discover running services, and potentially access sensitive cloud metadata (such as AWS instance credentials, Azure managed identities, or GCP service account keys) if your deployment runs on cloud infrastructure. The impact is elevated because cloud metadata services often grant significant privileges. Data accessed through metadata services could lead to account compromise or lateral movement. The requirement for authentication limits the attack surface to users with legitimate access, but insider threats or compromised accounts make this a meaningful risk.

Affected systems

Flowise before version 3.1.0 is affected. This includes all installations running 3.0.x and earlier releases. Organizations using Flowise in production or development environments that execute flows from untrusted or semi-trusted users are at highest risk. Self-hosted and cloud-hosted deployments are equally vulnerable if they have not patched.

Exploitability

Exploitation requires valid authentication to Flowise, which moderates—but does not eliminate—risk. No user interaction is required; an attacker with credentials can directly trigger the Execute Flow node with a malicious base URL. The attack is network-accessible and straightforward to execute: craft a flow, set the base URL to an internal address (e.g., http://169.254.169.254/latest/meta-data/), and trigger execution. The low complexity of the attack vector combined with the authentication requirement yields a CVSS 3.1 score of 7.1 (High). The vulnerability is not currently tracked on the CISA Known Exploited Vulnerabilities (KEV) catalog, though this may reflect publication recency rather than absence of active exploitation.

Remediation

Upgrade Flowise to version 3.1.0 or later immediately. Version 3.1.0 implements proper validation of user-supplied URLs to reject requests to private IP ranges, loopback addresses, and reserved ranges. As an interim mitigation pending patching, restrict Execute Flow node usage to trusted users only, implement network egress filtering to block outbound connections to internal address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.169.254), and monitor outbound HTTP requests from your Flowise instance for suspicious internal or metadata endpoints.

Patch guidance

Update Flowise to 3.1.0 or any later version released after 2026-06-23. Verify the patch is applied by checking the application version in the admin panel or package manifest. If you are unable to patch immediately, apply the interim controls listed in the remediation summary. Test the patched version in a staging environment before production rollout to ensure compatibility with your existing flows.

Detection guidance

Monitor Flowise application logs for Execute Flow node invocations that include base URL parameters pointing to private IP ranges (10.x.x.x, 172.16–31.x.x, 192.168.x.x), loopback (127.x.x.x), or cloud metadata endpoints (169.254.169.254). Search for HTTP requests originating from the Flowise process directed to these ranges. Check firewall and network access logs for unexpected internal traffic sourced from your Flowise instance. Inspect HTTP request headers and response payloads for signs of metadata service access or enumeration of internal services. Enable audit logging on Flowise if available to track flow execution parameters.

Why prioritize this

This vulnerability merits prompt patching due to the HIGH CVSS score, the direct path to cloud credential theft, and the broad applicability across Flowise deployments. Although authentication is required, the ease of exploitation by insiders or compromised accounts, combined with the severity of potential impact (cloud credential compromise), makes this a priority for security teams managing Flowise in production environments. The recent publication date and lack of KEV designation suggest active disclosure is recent; monitor for public exploit development.

Risk score, explained

CVSS 3.1 score of 7.1 (High) reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for low-privilege authentication (PR:L), no user interaction needed (UI:N), single-scope impact (S:U), high confidentiality impact due to metadata service access (C:H), low integrity impact from limited write capability (I:L), and no availability impact (A:N). The score appropriately captures the threat posed by an authenticated attacker who can exfiltrate sensitive cloud credentials or enumerate internal infrastructure.

Frequently asked questions