PT-2026-34736 · Flowise · Flowise

Published 2026-04-16 · Updated 2026-04-23 · CVE-2026-41271

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description A Server-Side Request Forgery (SSRF) issue exists in the POST and GET API Chain components. This allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems by injecting malicious prompt templates. This can bypass API documentation constraints and redirect requests to sensitive internal services, potentially leading to internal network reconnaissance and data exfiltration.

Recommendations Update to version 3.1.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41271

GHSA-6R77-HQX7-7VW8

Affected Products

Flowise

References · 5

• 🔥 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6r77-hqx7-7vw8 · Exploit
• https://osv.dev/vulnerability/GHSA-6r77-hqx7-7vw8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41271 · Security Note
• https://github.com/FlowiseAI/Flowise · Note
• https://twitter.com/CVEnew/status/2047428074539769939 · Twitter Post