{"id":"EUVD-2026-25289","enisaUuid":"cdb6dc45-a19d-382b-99e1-b4bcbdd1d3b3","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list. This vulnerability is fixed in 3.1.0.","datePublished":"Apr 23, 2026, 7:16:08 PM","dateUpdated":"Apr 23, 2026, 8:18:56 PM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2x8m-83vc-6wv4\n","aliases":"CVE-2026-41272\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"187e3fa2-d18e-3ebf-a998-66ba9eeadbc1","product":{"name":"flowise-components","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"},{"id":"b17f8b63-571b-34fc-8228-b447248ff189","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"}],"enisaIdVendor":[{"id":"01f8650e-2406-3248-912c-b71b7e8a8cc7","vendor":{"name":"FlowiseAI"}}],"enisaIdVulnerability":[{"id":"23753147-cad9-3324-abec-176a0df00f12","vulnerability":{"id":"CVE-2026-41272","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list. This vulnerability is fixed in 3.1.0.","datePublished":"Apr 23, 2026, 7:16:08 PM","dateUpdated":"Apr 23, 2026, 8:18:56 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2x8m-83vc-6wv4\n","enisa_id":"EUVD-2026-25289\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"31e71e5e-0301-39ec-8161-2069c454dfec","product":{"name":"flowise-components","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"},{"id":"f5e01418-20c1-3122-9215-01a5ee417d1a","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"}],"vulnerabilityVendor":[{"id":"2a4a3a21-4e9d-39e1-b922-fb160eec55a6","vendor":{"name":"FlowiseAI"}}]}}],"enisaIdAdvisory":[]}