CVE-2026-31829: 
JavaScript vulnerability analysis and mitigation

CVE-2026-31829 is a Server-Side Request Forgery (SSRF) vulnerability in Flowise, a drag-and-drop UI for building customized LLM flows. The flaw exists in the HTTP Node component of AgentFlow and Chatflow, which performs server-side HTTP requests using user-controlled URLs without any restrictions on target hosts. All versions of the flowise and flowise-components npm packages up to and including 3.0.12 are affected; the vulnerability was fixed in version 3.0.13. The advisory was published on March 9, 2026, and assigned a CVSS v3.1 base score of 7.1 (High) by GitHub Advisory and 8.8 (High) by NVD (GitHub Advisory, Flowise Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the HTTP Node in Flowise's AgentFlow and Chatflow accepts a user-supplied URL and issues server-side HTTP requests without validating or restricting the target host. By default, no blocklist or allowlist is applied, meaning private IP ranges (RFC 1918), localhost (127.0.0.1), and cloud metadata endpoints (e.g., http://169.254.169.254) are all reachable. The HTTP Node supports all standard HTTP methods (GET, POST, PUT, PATCH, DELETE), enabling both read and write operations against internal services. A minimal three-node flow is sufficient to trigger the vulnerability, and because Flowise does not enforce authentication by default (FLOWISE_USERNAME/PASSWORD unset), the attack surface is particularly broad (Flowise Advisory, GitHub Advisory).

Successful exploitation allows any user interacting with a publicly exposed chatflow to force the Flowise server to issue arbitrary HTTP requests to internal network resources. Attackers can retrieve cloud provider metadata credentials (e.g., AWS IAM credentials via IMDSv1 at http://169.254.169.254/latest/meta-data/iam/security-credentials/), access internal admin panels (Jenkins, Kubernetes API, company dashboards), and perform port scanning of internal services. Write-capable HTTP methods enable modification or deletion of internal resources, creation of malicious configurations, and triggering destructive actions on CI/CD systems. Retrieved credentials can be leveraged for lateral movement and privilege escalation beyond the Flowise instance (Flowise Advisory, GitHub Advisory).

A proof-of-concept is publicly available in the GitHub Security Advisory, demonstrating step-by-step reproduction using a minimal three-node flow that successfully retrieves content from an internal service at http://127.0.0.1:8000. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.038–0.103% (28th percentile), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is detected by Qualys (detection ID 5008999) and is not currently listed in the CISA KEV catalog (Flowise Advisory, GitHub Advisory).

1. Reconnaissance: Identify publicly exposed Flowise instances (versions ≤ 3.0.12) using search engines like Shodan or Censys, targeting default Flowise ports. Check whether authentication is disabled (no FLOWISE_USERNAME/FLOWISE_PASSWORD set), which is the default configuration.
2. Access the Flowise UI: Navigate to the publicly accessible Flowise interface. If unauthenticated, proceed directly; otherwise, use any valid low-privilege account.
3. Create or modify a flow: In AgentFlow or Chatflow, construct a minimal flow containing an HTTP Node. Configure the HTTP Node with a target URL pointing to an internal resource, such as http://127.0.0.1:8000, http://169.254.169.254/latest/meta-data/iam/security-credentials/, or any RFC 1918 address.
4. Trigger the flow via chat input: Send a chat message to activate the flow. The Flowise server will issue the configured HTTP request to the internal target on behalf of the attacker.
5. Retrieve sensitive data: The response from the internal service (e.g., AWS IAM credentials, internal admin panel content, Kubernetes API data) is returned through the chatflow output.
6. Escalate or pivot: Use retrieved credentials or data to perform lateral movement, privilege escalation, or further attacks against cloud infrastructure or internal services (Flowise Advisory, GitHub Advisory).

• Network: Outbound HTTP requests from the Flowise server process to RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.1), or cloud metadata endpoints (169.254.169.254); unexpected connections to internal services such as Kubernetes API (port 6443), Jenkins (port 8080), or other admin panels.
• Logs: Flowise application logs showing HTTP Node executions with internal or metadata URLs as targets; access logs reflecting chat input triggering flows with suspicious URL parameters; repeated requests to http://169.254.169.254/latest/meta-data/ from the Flowise process.
• Process/Behavior: Flowise server process initiating connections to internal network segments not normally accessed; unusual volume of outbound HTTP requests from the Flowise container or host, particularly to non-public IP ranges.
• File System: New or modified flow configurations containing HTTP Nodes with hardcoded internal IP addresses or metadata endpoint URLs (Flowise Advisory).

Upgrade both flowise and flowise-components npm packages to version 3.0.13 or later, which contains the fix for this vulnerability. If immediate patching is not possible, restrict access to publicly exposed chatflows to trusted users only by enabling authentication (FLOWISE_USERNAME/FLOWISE_PASSWORD). Implement network segmentation to prevent the Flowise server from reaching internal IP ranges, cloud metadata endpoints, and sensitive internal services. Monitor outbound HTTP requests from Flowise instances for suspicious activity targeting internal resources (Flowise Advisory, GitHub Advisory).

The vulnerability was discussed on Reddit's r/netsec in a thread covering 22 security advisories related to AI/ML tools, reflecting broader community interest in SSRF risks within the growing LLM tooling ecosystem. The advisory was reported by security researcher nlgbao1340 and published by igor-magun-wd. Check Point also published a defense advisory (CPAI-2026-4536) referencing this CVE. No major vendor statements beyond the FlowiseAI advisory itself have been identified (GitHub Advisory).