Description

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.1.3 is able to resolve this issue. The patch is identified as 700137738bcaebefd4709021f6d6b0abcd7df0ac. It is recommended to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-13T20:16:51.317Z",
  "pubdate": "2026-09-13T20:16:51.317Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in FlowiseAI Flowise versions up to 3.0.2.\nThe vulnerability resides within the Evaluations Endpoint, specifically affecting the axios.post function in packages/server/src/controllers/evaluations/index.ts.\nBy manipulating HTTP headers such as Host or X-Forwarded-Proto, an unauthenticated remote attacker can coerce the server into initiating unauthorized outbound requests to arbitrary destinations.\nThis vulnerability poses a significant security risk, as it allows attackers to bypass network access controls, interact with internal services that are otherwise unreachable from the internet, or perform reconnaissance within the underlying infrastructure.\nThe exploit is currently public, necessitating immediate attention.\nThe primary risk involves the potential for data exfiltration, internal service exploitation, or exposure of metadata services in cloud environments.",
  "technicalDetails": "The vulnerability is caused by improper sanitization and validation of user-controllable input headers used in server-side HTTP requests within the evaluations component.\nSpecifically, the file packages/server/src/controllers/evaluations/index.ts utilizes the axios.post function to facilitate requests based on input parameters derived from the incoming HTTP request context.\nThe application fails to adequately restrict or validate the Host or X-Forwarded-Proto headers when constructing these backend requests. An attacker can inject malicious values into these headers to redirect the underlying HTTP client to unintended internal or external targets.\nThe attack flow begins when an attacker sends a crafted HTTP request to the vulnerable Evaluations Endpoint. By manipulating the Host or X-Forwarded-Proto headers, the attacker instructs the axios instance to direct its POST request to a target of their choosing instead of the intended service.\nBecause the server initiates the request on behalf of the user, it may leverage the server's identity or internal network positioning to bypass perimeter firewalls or access restricted internal APIs and services.\nThe vulnerability is remotely exploitable, requiring no prior authentication or specific privileges to trigger the SSRF condition. Since the exploitation vector is public, the barrier to entry for potential adversaries is minimal.\nUpon successful exploitation, the server-side axios request acts as a proxy for the attacker. The post-exploitation impact includes the ability to scan internal network segments, exfiltrate sensitive data from internal systems, or reach internal-only administrative interfaces. This could lead to a full compromise of the backend environment depending on the sensitivity of the internal services reachable via this SSRF primitive."
}