PT-2026-34735 · Flowise · Flowise

Published 2026-04-16 · Updated 2026-04-23 · CVE-2026-41270

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description A Server-Side Request Forgery (SSRF) protection bypass exists in the Custom Function feature. Although the application uses HTTP DENY LIST to protect axios and node-fetch libraries, the built-in Node.js http, https, and net modules are permitted within the NodeVM sandbox without similar protections. This allows authenticated users to circumvent SSRF controls and access internal network resources, such as cloud provider metadata services.

Recommendations Update to version 3.1.0.

Exploit

Fix

Improper Access Control

SSRF

Weakness Enumeration

CWE-284

CWE-918

Related Identifiers

CVE-2026-41270

GHSA-XHMJ-RG95-44HV

Affected Products

Flowise

References · 5

• 🔥 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhmj-rg95-44hv · Exploit
• https://osv.dev/vulnerability/GHSA-xhmj-rg95-44hv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41270 · Security Note
• https://github.com/FlowiseAI/Flowise · Note
• https://twitter.com/CVEnew/status/2047428076469182822 · Twitter Post