CVE-2026-31829 - Vulnerability Analysis

Overview

Flowise < 3.0.13 contains a server-side request forgery caused by unrestricted HTTP Node requests using user-controlled URLs, letting attackers make requests to internal network resources, exploit requires user interaction with chatflow.

Severity & Score

Impact

Attackers can make the server perform unauthorized requests to internal network resources, potentially exposing sensitive data or services.

Mitigation

Upgrade to version 3.0.13 or later.

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fvcw-9w9r-pxc7

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner