Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticated attackers to force the server to issue arbitrary GET requests to cloud instance metadata services. Attackers can send requests to the fetch-links API endpoint with a crafted URL parameter, bypassing deny-list validation including redirect-based bypasses, to reach instance metadata services and expose instance identity data and role credentials on Oracle Cloud Infrastructure or Alibaba Cloud deployments, with unauthenticated access possible when URL-fetching nodes exist in public chatflows.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-67620: Flowise Cloud Metadata SSRF Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04z5K270
Post summary
The text announces CVE-2026-67620 as an SSRF vulnerability in Flowise Cloud, providing basic technical details without specifying exploits, patches, or active exploitation.
🤖 Flowise AI platform hit by cloud-focused SSRF flaw CVE-2026-67620 affects Flowise through version 3.1.4. An incomplete SSRF protection list can allow an authenticated attacker to make requests toward cloud metadata services, potentially exposing sensitive cloud-instance information. 📊 Severity: High 🔎 Source: Rapid7 / CVE. #AISecurity #Flowise #CloudSecurity #SSRF #CVE
Post summary
CVE‑2026‑67620 is a high‑severity Server‑Side Request Forgery vulnerability affecting Flowise AI platform version 3.1.4; the announcement provides technical details but no PoC, exploit, active‑exploit report, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | flowiseai | flowise | - | - | - |