CVE catalog

CVE-2026-56275

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base

[CVE catalog]

Severity: High · CVSS 7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Published: Apr 15, 2026, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.32% · Oct 25, 2026

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud metadata, and enumerate internal services by exploiting the missing secureFetch verification in httpSecurity.ts.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Cpe	flowise	Not reported	`3.1.0`	fixed
Npm	flowise	Not reported	`3.1.0`	fixed
Npm	flowise-components	Not reported	`3.1.0`	fixed
Cpe	flowise	Not reported	`3.1.0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Cpe	flowise	cpe	Not reported	`3.1.0`	Not reported	Not reported	Not reported
Npm	flowise	npm	Not reported	`3.1.0`	Not reported	GHSA-9HRV-GVRV-6GF2	Not reported
Npm	flowise-components	npm	Not reported	`3.1.0`	Not reported	GHSA-9HRV-GVRV-6GF2	Not reported
Cpe	flowise	cpe	Not reported	`3.1.0`	Not reported	NVD-CVE-2026-56275	Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 26, 2026, 2:51:20 AM UTC

References

[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)]