Description

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticated attackers to force the server to issue arbitrary GET requests to cloud instance metadata services. Attackers can send requests to the fetch-links API endpoint with a crafted URL parameter, bypassing deny-list validation including redirect-based bypasses, to reach instance metadata services and expose instance identity data and role credentials on Oracle Cloud Infrastructure or Alibaba Cloud deployments, with unauthenticated access possible when URL-fetching nodes exist in public chatflows.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-08T16:16:49.420Z",
  "pubdate": "2026-08-08T16:16:49.420Z",
  "executiveSummary": "Flowise through version 3.1.4 suffers from a Server-Side Request Forgery (SSRF) vulnerability located within the SSRF guard implemented in httpSecurity.ts. The flaw arises from an incomplete DEFAULT_DENY_LIST that fails to block specific cloud provider metadata endpoints, specifically the Oracle Cloud Infrastructure metadata endpoint at 192.0.0.192 and the Alibaba Cloud metadata endpoint at 100.100.100.200.\nAuthenticated attackers, or potentially unauthenticated attackers when URL-fetching nodes are exposed within public chatflows, can leverage this oversight to force the server into issuing arbitrary GET requests. By interacting with the fetch-links API endpoint using a crafted URL parameter, adversaries can bypass deny-list validation mechanisms, including redirect-based bypass vectors.\nSuccessful exploitation allows unauthorized access to critical cloud instance metadata services. This exposure compromises instance identity data and sensitive role credentials specific to Oracle Cloud Infrastructure or Alibaba Cloud deployments, severely impacting the confidentiality and integrity of the underlying infrastructure.",
  "technicalDetails": "The vulnerability resides in the httpSecurity.ts component of Flowise versions up to and including 3.1.4, specifically within the validation logic governing outbound HTTP requests managed by the SSRF guard and its underlying DEFAULT_DENY_LIST.\nThe root cause is an insufficient IP address restriction policy. While typical cloud metadata services are guarded, the DEFAULT_DENY_LIST omits critical provider endpoints, namely 192.0.0.192 for Oracle Cloud Infrastructure and 100.100.100.200 for Alibaba Cloud.\nThe attack flow begins when an adversary targets the fetch-links API endpoint. The attacker supplies a crafted URL parameter designed to point directly to the unlisted metadata IP addresses or utilizes redirect-based techniques to route traffic through an intermediary to the restricted destinations.\nBecause the httpSecurity.ts validation checks do not flag 192.0.0.192 or 100.100.100.200 as forbidden targets, the application processes the outbound request, executing an arbitrary GET request originating from the hosting server environment.\nAuthentication requirements vary based on deployment configuration; while authenticated attackers can reliably target the API, unauthenticated exploitation is entirely feasible if URL-fetching nodes are publicly accessible within active chatflows.\nUpon successful payload delivery, the server communicates with the instance metadata service and returns sensitive operational data. Post-exploitation impact includes the exposure of instance identity tokens, temporary security credentials, and role-based permissions, which can be leveraged to pivot deeper into the cloud environment."
}