プラットフォーム
nodejs
コンポーネント
flowise
修正版
3.0.14
3.0.13
CVE-2026-31829 describes a Server-Side Request Forgery (SSRF) vulnerability discovered in Flowise, specifically within its AgentFlow and Chatflow HTTP Node functionality. This flaw allows attackers to manipulate the Flowise server into making HTTP requests to internal resources, bypassing typical network security boundaries. The vulnerability impacts versions prior to 3.0.13 and can lead to unauthorized access to sensitive internal data and systems. A fix has been released in version 3.0.13.
The SSRF vulnerability in Flowise allows an attacker to leverage the Flowise server as a proxy to access internal resources that are otherwise inaccessible from the public internet. This includes internal admin panels, databases, and other sensitive services. An attacker could potentially exfiltrate sensitive data, modify configurations, or even gain a foothold within the internal network. The ability to target RFC 1918 IP ranges, localhost, and cloud metadata endpoints significantly expands the potential attack surface. Successful exploitation could lead to a complete compromise of internal systems, depending on the permissions and access granted to the Flowise server.
CVE-2026-31829 was publicly disclosed on 2026-03-10. The vulnerability's ease of exploitation and potential impact suggest a medium probability of exploitation (EPSS score pending). No public proof-of-concept (POC) code has been released at the time of writing, but the SSRF nature of the vulnerability makes it likely that a POC will emerge. It is not currently listed on the CISA KEV catalog.
Organizations deploying Flowise in environments with internal services or sensitive data are at risk. This includes those using Flowise for internal tooling, data analysis, or chatbot applications. Shared hosting environments where Flowise instances are running alongside other applications are particularly vulnerable, as a compromised Flowise instance could potentially be used to attack other tenants on the same server.
• nodejs / server:
ps aux | grep flowise• nodejs / server:
journalctl -u flowise -f | grep "HTTP Node"• generic web: Use curl or wget to test if internal resources can be accessed through the Flowise instance by crafting a malicious URL with an internal IP address.
curl http://<internal_ip>/pathdisclosure
エクスプロイト状況
EPSS
0.05% (15% パーセンタイル)
CISA SSVC
CVSS ベクトル
The primary mitigation for CVE-2026-31829 is to immediately upgrade Flowise to version 3.0.13 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting outbound network access for the Flowise server using a firewall or network segmentation. WAF rules can be configured to block requests to known internal IP ranges or metadata endpoints. Carefully review and restrict the permissions granted to the user account running the Flowise server to minimize the potential impact of a successful SSRF attack. After upgrading, confirm the fix by attempting to access an internal resource via the HTTP Node and verifying that the request is denied.
Flowise をバージョン 3.0.13 以降にアップデートしてください。このバージョンでは、HTTP ノードの SSRF 脆弱性が修正され、内部ネットワークリソースへの不正アクセスが防止されます。
脆弱性分析と重要アラートをメールでお届けします。
CVE-2026-31829 is a Server-Side Request Forgery vulnerability in Flowise versions before 3.0.13, allowing attackers to access internal resources via manipulated HTTP requests.
You are affected if you are using Flowise versions prior to 3.0.13 and have not implemented mitigating controls.
Upgrade Flowise to version 3.0.13 or later. As a temporary workaround, restrict outbound network access for the Flowise server using a firewall or WAF.
While no active exploitation has been confirmed, the vulnerability's nature makes it likely that exploitation attempts will occur.
Refer to the Flowise project's official security advisories and release notes for details: [https://flowise.com/docs/security](https://flowise.com/docs/security)
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。