Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list. This vulnerability is fixed in 3.1.0.

Source published

23 Apr 2026 19:16:08 UTC

Source modified

23 Apr 2026 20:18:56 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list. This vulnerability is fixed in 3.1.0.

Source published

Apr 23, 2026, 7:16:08 PM (timezone not stated)

Source modified

Apr 23, 2026, 8:18:56 PM (timezone not stated)

Observed here

1 Nov 2026 07:06:28 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list. This vulnerability is fixed in 3.1.0.

Source published

23 Apr 2026 20:16:15 UTC

Source modified

26 Oct 2026 22:10:00 UTC

Observed here

27 Oct 2026 10:10:07 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

### Summary The core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list. ### Details The flaws exist in `packages/components/src/httpSecurity.ts`. Default Insecure: If process.env.HTTP_DENY_LIST is undefined, checkDenyList returns immediately, allowing all requests (including localhost). DNS Rebinding (TOCTOU): The function performs a DNS lookup (dns.lookup) to validate the IP, and then the HTTP client performs a new lookup to connect. An attacker can serve a valid IP first, then switch to an internal IP (e.g., `127.0.0.1`) for the second lookup. ### PoC Ensure `HTTP_DENY_LIST` is unset (default behavior). Use any node utilizing secureFetch to access `http://127.0.0.1`. Result: Request succeeds. #### Scenario 2: DNS Rebinding Attacker controls domain attacker.com and a custom DNS server. Configure DNS to return `1.1.1.1` (Safe IP) with TTL=0 for the first query. Configure DNS to return `127.0.0.1` (Blocked IP) for subsequent queries. Flowise validates `attacker.com` -> `1.1.1.1` (Allowed). Flowise fetches `attacker.com` -> `127.0.0.1` (Bypass). Run the following for manual verification ```ts // PoC for httpSecurity.ts Bypasses import * as dns from 'dns/promises'; // Mocking the checkDenyList logic from Flowise async function checkDenyList(url: string) { const deniedIPs = ['127.0.0.1', '0.0.0.0']; // Simplified deny list logic if (!process.env.HTTP_DENY_LIST) { console.log(\"⚠️ HTTP_DENY_LIST not set. Returning allowed.\"); return; // Vulnerability 1: Default Insecure } const { hostname } = new URL(url); const { address } = await dns.lookup(hostname); if (deniedIPs.includes(address)) { throw new Error(`IP ${address} is denied`); } console.log(`✅ IP ${address} allowed check.`); } async function runPoC() { console.log(\"--- Test 1: Default Configuration (Unset HTTP_DENY_LIST) ---\"); // Ensure env var is unset delete process.env.HTTP_DENY_LIST; try { await checkDenyList('http://127.0.0.1'); console.log(\"[PASS] Default config allowed localhost access.\"); } catch (e) { console.log(\"[FAIL] Blocked:\", e.message); } console.log(\"\ --- Test 2: 'private' Keyword Bypass (Logic Flaw) ---\"); process.env.HTTP_DENY_LIST = 'private'; // User expects this to block localhost try { await checkDenyList('http://127.0.0.1'); // In real Flowise code, 'private' is not expanded to IPs, so it only blocks the string \"private\" console.log(\"[PASS] 'private' keyword failed to block localhost (Mock simulation).\"); } catch (e) { console.log(\"[FAIL] Blocked:\", e.message); } } runPoC(); ``` ### Impact Confidentiality: High (Access to internal services if protection is bypassed). Integrity: Low/Medium (If internal services allow state changes via GET). Availability: Low.

Source published

16 Apr 2026 21:51:00 UTC

Source modified

5 May 2026 16:11:44 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Publisher rating · HIGH