Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet. This vulnerability is fixed in 3.0.13.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-10 | 1 | General1 |
| 2026-03-11 | 1 | Disclosure1 |
| 2026-04-12 | 1 | Disclosure1 |
CVE-2026-31829 Server-Side Request Forgery in Flowise Chatflow HTTP Node Before 3.0.13 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-31829
Post summary
A newly identified Server‑Side Request Forgery vulnerability (CVE‑2026‑31829) affects Flowise Chatflow HTTP Node versions before 3.0.13, as reported on vulmon.com.
`Flowise` is affected by a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-31829) in its HTTP Node, potentially allowing internal network access. Investigate network segmentation and outbound request filtering. #Flowise #SSRF #infosec https://www.pulsepatch.io/posts/cve-2026-31829-flowise-ssrf
Post summary
Flowise is affected by a Server‑Side Request Forgery (SSRF) vulnerability (CVE‑2026‑31829) that could permit internal network access; recommended mitigations include network segmentation and outbound request filtering.
CVE-2026-31829 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that … https://www.cve.org/CVERecord?id=CVE-2026-31829
Post summary
The post only states the CVE identifier, provides a vendor description of a feature, and links to the CVE record, without any evidence of a PoC, exploit, active attacks, patch, or detailed technical details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | flowiseai | flowise | - | - | - |