{"id":"CVE-2026-56275","revision":"062646cfff0d478eaaa7513f774958f8","records":[{"revision":"062646cfff0d478eaaa7513f774958f8","observedAt":"2026-10-25T14:19:05.298+00:00","statement":{"source":"nvd","id":"CVE-2026-56275","aliases":[],"title":"Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP r…","description":"Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud metadata, and enumerate internal services by exploiting the missing secureFetch verification in httpSecurity.ts.","state":0,"publishedAt":"2026-06-23T13:16:45.223+00:00","modifiedAt":"2026-06-25T18:39:37.92+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","score":7.1,"severity":"HIGH"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9hrv-gvrv-6gf2","https://www.vulncheck.com/advisories/flowise-server-side-request-forgery-via-execute-flow-base-url"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56275","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-918"],"productCriteria":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-06-23T13:16:45.223","lastModified":"2026-06-25T18:39:37.920"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-56275","identifiers":["CVE-2026-56275"]},"retained":false,"historicalAffected":[]}],"coverage":[]}