CVE-2026-41270

CVE-2026-41270 is a Server-Side Request Forgery (SSRF) protection bypass vulnerability in Flowise, an open-source drag-and-drop user interface for building customized large language model (LLM) flows. The issue affects versions prior to 3.1.0 and resides in the Custom Function feature, where SSRF protections are implemented via an HTTP_DENY_LIST for the axios and node-fetch libraries. However, the built-in Node.js http, https, and net modules remain unrestricted within the NodeVM sandbox, enabling attackers to circumvent these controls. The vulnerability is associated with CWE-284 (Improper Access Control) and CWE-918 (SSRF), with a CVSS v3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).

Authenticated users with low privileges (PR:L) can exploit this vulnerability over the network, though it requires high attack complexity (AC:H). By crafting custom functions that leverage the unprotected Node.js modules, attackers can bypass SSRF mitigations and make unauthorized requests to internal network resources, such as cloud provider metadata services. Successful exploitation grants high confidentiality and integrity impacts (C:H/I:H), along with low availability impact (A:L), potentially allowing attackers to exfiltrate sensitive data or pivot within the internal network.

The official GitHub security advisory (GHSA-xhmj-rg95-44hv) confirms that the vulnerability is fully remediated in Flowise version 3.1.0, recommending that users upgrade immediately to mitigate the risk. No additional workarounds are detailed in the provided information.

Flowise's focus on LLM orchestration introduces AI/ML relevance, as exploited instances could compromise AI workflows by accessing internal services that inform model behaviors or data pipelines. No evidence of real-world exploitation is available in the provided details.