Vulnerability · Published Jun 23, 2026 · Assigned by VulnCheck

CVE-2026-56275Flowise - Server-Side Request Forgery via Execute Flow Base URL

Medium 6.0

In plain English

A medium-severity server-side request forgery in Flowise from Flowise. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.0Medium

Exploit odds (30 days)0.3%top 75.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud metadata, and enumerate internal services by exploiting the missing secureFetch verification in httpSecurity.ts.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	flowise	3.1.0	GHSA-9hrv-gvrv-6gf2
npm	flowise-components	3.1.0	GHSA-9hrv-gvrv-6gf2

Affected products (as reported)

Vendor	Product	Versions
Flowise	Flowise	0 – before 3.1.0
Flowise	Flowise	0 – before 3.1.0

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-9hrv-gvrv-6gf2) vendor-advisory
VulnCheck Advisory: Flowise - Server-Side Request Forgery via Execute Flow Base URL third-party-advisory