CVE-2025-59527: SSRF in Flowise

The SSRF vulnerability in Flowise allows an attacker to craft malicious requests that are executed by the Flowise server. Because the server acts as a proxy, the attacker can bypass network restrictions and access internal web services that would normally be inaccessible from the outside. This could include sensitive administrative panels, internal APIs, or other resources that contain confidential data. The potential impact extends to information disclosure, unauthorized access to internal systems, and potentially even the execution of arbitrary code if vulnerable internal services are exposed. Exploitation could reveal internal network topology and expose vulnerabilities in other internal systems.

1. Reserved2025-09-17
2. Published2025-09-15
3. Modified2025-09-22
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-59527 is to upgrade Flowise to version 3.0.6 or later, which contains the fix for the SSRF vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting outbound network access from the Flowise server to only necessary domains. Implement a Web Application Firewall (WAF) with rules to block requests to the /api/v1/fetch-links endpoint or filter requests based on URL patterns that could indicate SSRF exploitation. Monitor Flowise server logs for unusual outbound requests or connections to unexpected internal resources.