PT-2026-34737 · Flowiseai · Flowise+1
Published
2026-04-23
·
Updated
2026-04-23
·
CVE-2026-41272
CVSS v3.1
7.1
High
| AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L |
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list. This vulnerability is fixed in 3.1.0.
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flowise
Flowise-Components