CVE-2026-31829: Flowise HTTP Node Vulnerability Allows Server-Side Request Forgery (SSRF)
Summary
CVE-2026-31829: Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access. Affects flowise versions < 3.0.13. Fixed in 3.0.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Flowise is an open-source tool designed for building and deploying workflows that integrate various services and APIs. It features an HTTP Node that allows users to make HTTP requests to specified URLs. However, this functionality can be exploited due to a lack of restrictions on the target hosts, making it vulnerable to SSRF attacks. This vulnerability can lead to unauthorized access to internal network resources.
Vulnerability Detail
The vulnerability arises from the HTTP Node in Flowise, which allows users to specify URLs for server-side HTTP requests without any restrictions. This means that users can direct the Flowise server to access internal services, including private IP ranges and cloud metadata endpoints. The implications of this vulnerability are severe, as it can lead to unauthorized access to sensitive internal data, retrieval of cloud provider metadata, and potential lateral movement within compromised environments. Attackers can exploit this vulnerability to read sensitive information or modify internal resources, posing a significant risk to organizations.
How To Fix
Latest published version: 3.1.4 as of 22 Oct 2026
npm install flowise@3.1.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.13
This is the first release that contains the fix.
npm install flowise@3.0.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Flowise application by implementing network-level controls, such as firewalls or VPNs, to prevent unauthorized users from accessing the application. Additionally, consider disabling the HTTP Node functionality until the vulnerability is patched.
Conclusion
The CVE-2026-31829 vulnerability in Flowise's HTTP Node poses significant risks due to its potential for SSRF attacks. Organizations using Flowise should promptly update to the patched version and consider implementing additional security measures to mitigate risks associated with this vulnerability.
See every vulnerability recorded for flowise →
FAQ
SSRF is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access to sensitive data.
If you are using Flowise version 3.0.12 or earlier, your instance is vulnerable. You can check your version by running 'npm list flowise' in your terminal.
The impacts include unauthorized access to internal services, retrieval of sensitive data, and the ability to modify or delete internal resources, which can lead to significant security breaches.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. You can check if your application is affected by visiting the Vulert playground.
If immediate updates are not possible, implement network-level security measures to restrict access to the Flowise application and disable the HTTP Node functionality as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for flowise.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
