CVE-2026-41270 - Vulnerability Analysis

Overview

Flowise < 3.1.0 contains a server side request forgery protection bypass caused by incomplete SSRF filtering in Custom Function feature allowing use of Node.js http, https, and net modules, letting authenticated users access internal network resources.

Severity & Score

Impact

Authenticated users can bypass SSRF protections to access internal network resources, potentially exposing sensitive internal data.

Mitigation

Update to version 3.1.0 or later.

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xhmj-rg95-44hv

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner