CVE-2026-41270

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and node-fetch libraries, the built-in Node.js http, https, and net modules are allowed in the NodeVM sandbox without equivalent protection. This allows authenticated users to bypass SSRF controls and access internal network resources (e.g., cloud provider metadata services) This vulnerability is fixed in 3.1.0.

• CWE-284
• CWE-918

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhmj-rg95-44hvExploit, Vendor Advisory
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhmj-rg95-44hvExploit, Vendor Advisory

Published

Apr 23, 2026

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41265Flowise is a drag & drop user interface to build a customize…9.8
• CVE-2026-41266Flowise is a drag & drop user interface to build a customize…7.5
• CVE-2026-41267Flowise is a drag & drop user interface to build a customize…9.8
• CVE-2026-41268Flowise is a drag & drop user interface to build a customize…9.8
• CVE-2026-41269Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-4127The Speedup Optimization plugin for WordPress is vulnerable …4.3
• CVE-2026-41271Flowise is a drag & drop user interface to build a customize…8.3
• CVE-2026-41272Flowise is a drag & drop user interface to build a customize…7.1
• CVE-2026-41273Flowise is a drag & drop user interface to build a customize…8.2
• CVE-2026-41274Flowise is a drag & drop user interface to build a customize…9.8
• CVE-2026-41275Flowise is a drag & drop user interface to build a customize…7.5
• CVE-2026-41276Flowise is a drag & drop user interface to build a customize…9.8