平台
nodejs
组件
flowise
修复版本
3.0.14
3.0.13
CVE-2026-31829 describes a Server-Side Request Forgery (SSRF) vulnerability discovered in Flowise, specifically within its AgentFlow and Chatflow HTTP Node functionality. This flaw allows attackers to manipulate the Flowise server into making HTTP requests to internal resources, bypassing typical network security boundaries. The vulnerability impacts versions prior to 3.0.13 and can lead to unauthorized access to sensitive internal data and systems. A fix has been released in version 3.0.13.
The SSRF vulnerability in Flowise allows an attacker to leverage the Flowise server as a proxy to access internal resources that are otherwise inaccessible from the public internet. This includes internal admin panels, databases, and other sensitive services. An attacker could potentially exfiltrate sensitive data, modify configurations, or even gain a foothold within the internal network. The ability to target RFC 1918 IP ranges, localhost, and cloud metadata endpoints significantly expands the potential attack surface. Successful exploitation could lead to a complete compromise of internal systems, depending on the permissions and access granted to the Flowise server.
CVE-2026-31829 was publicly disclosed on 2026-03-10. The vulnerability's ease of exploitation and potential impact suggest a medium probability of exploitation (EPSS score pending). No public proof-of-concept (POC) code has been released at the time of writing, but the SSRF nature of the vulnerability makes it likely that a POC will emerge. It is not currently listed on the CISA KEV catalog.
Organizations deploying Flowise in environments with internal services or sensitive data are at risk. This includes those using Flowise for internal tooling, data analysis, or chatbot applications. Shared hosting environments where Flowise instances are running alongside other applications are particularly vulnerable, as a compromised Flowise instance could potentially be used to attack other tenants on the same server.
• nodejs / server:
ps aux | grep flowise• nodejs / server:
journalctl -u flowise -f | grep "HTTP Node"• generic web: Use curl or wget to test if internal resources can be accessed through the Flowise instance by crafting a malicious URL with an internal IP address.
curl http://<internal_ip>/pathdisclosure
漏洞利用状态
EPSS
0.05% (15% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2026-31829 is to immediately upgrade Flowise to version 3.0.13 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting outbound network access for the Flowise server using a firewall or network segmentation. WAF rules can be configured to block requests to known internal IP ranges or metadata endpoints. Carefully review and restrict the permissions granted to the user account running the Flowise server to minimize the potential impact of a successful SSRF attack. After upgrading, confirm the fix by attempting to access an internal resource via the HTTP Node and verifying that the request is denied.
升级 Flowise 到 3.0.13 或更高版本。此版本修复了 HTTP Node 中的 SSRF 漏洞，防止了对内部网络资源的未经授权访问。
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2026-31829 is a Server-Side Request Forgery vulnerability in Flowise versions before 3.0.13, allowing attackers to access internal resources via manipulated HTTP requests.
You are affected if you are using Flowise versions prior to 3.0.13 and have not implemented mitigating controls.
Upgrade Flowise to version 3.0.13 or later. As a temporary workaround, restrict outbound network access for the Flowise server using a firewall or WAF.
While no active exploitation has been confirmed, the vulnerability's nature makes it likely that exploitation attempts will occur.
Refer to the Flowise project's official security advisories and release notes for details: [https://flowise.com/docs/security](https://flowise.com/docs/security)
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。