PT-2026-24483 · Flowise · Flowise

Nlgbao1340 · Published 2026-03-10 · Updated 2026-04-12 · CVE-2026-31829

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.13

Description Flowise, a drag & drop user interface for building customized large language model flows, contains a Server-Side Request Forgery (SSRF) issue. The application exposes an HTTP Node within AgentFlow and Chatflow that makes server-side HTTP requests using URLs controlled by the user. There are no restrictions on the target hosts, allowing requests to private IP ranges, localhost, or cloud metadata endpoints. This enables an attacker interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are otherwise inaccessible from the public internet.

Recommendations Update to version 3.0.13 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-31829

GHSA-FVCW-9W9R-PXC7

Affected Products

Flowise

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31829.json · Exploit
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fvcw-9w9r-pxc7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fvcw-9w9r-pxc7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31829 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31829 · Security Note
• https://github.com/FlowiseAI/Flowise · Note
• https://t.me/CVEtracker/47035 · Telegram Post
• https://raxe.ai/labs/advisories · Reddit Post
• https://twitter.com/CVEnew/status/2031504067000762489 · Twitter Post
• https://twitter.com/pulsepatchio/status/2043165028501647442 · Twitter Post