Server-Side Request Forgery (SSRF) in Flowise - CVE-2026-56275
Published: April 15, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU126232
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-56275
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper restriction of server-side request targets in Execute Flow base url handling when processing a prediction request. A remote user can provide a crafted intranet address in the base url field to disclose sensitive information.
Exploitation can cause the server to initiate HTTP requests to internal network addresses, including cloud metadata services, and can be used to detect internal network services.
Affected software
Flowise
How to mitigate CVE-2026-56275
Install security update from vendor's website.
Flowise - update to 3.1.0