Description

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata services or internal hosts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-15T16:17:44.867Z",
  "pubdate": "2026-09-15T16:17:44.867Z",
  "executiveSummary": "Flowise versions prior to 3.1.4 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability due to improper input validation within chat-model node configurations.\nThe vulnerability permits authenticated users with 'chatflows:create' or 'chatflows:update' permissions to manipulate the 'baseURL' parameter, enabling them to force the application to send HTTP requests to arbitrary destinations.\nThis flaw grants an attacker the ability to bypass network segmentation and interact with internal services or cloud provider metadata endpoints (e.g., 169.254.169.254).\nThe primary risk implication is the potential exfiltration of sensitive LLM provider API keys or other internal credentials stored within the application environment.\nExploitation requires authenticated access to the system, specifically targeting users with the authorization to modify or create chatflows, making this a significant escalation risk for multi-tenant or collaborative environments.",
  "technicalDetails": "The vulnerability resides in the chat-model node configuration logic, which fails to adequately sanitize or validate user-supplied input provided to the 'baseURL' parameter.\nWhen a chat-model node is initialized, the application constructs outgoing requests to LLM providers using the user-defined base URL. Because the implementation lacks a whitelist or domain validation mechanism, it is possible to inject arbitrary URLs.\nThe attack flow begins when an authenticated user with sufficient privileges creates or modifies a chatflow, replacing the legitimate LLM provider endpoint with a malicious URI or an internal network address.\nUpon execution of the chatflow, the Flowise backend performs a server-side request to the attacker-controlled 'baseURL'. This request can be crafted to target local services, such as the cloud metadata service (e.g., AWS, GCP, or Azure), which typically returns sensitive instance metadata, including temporary security credentials.\nIf the attacker directs the request to a server they control, they can capture the outgoing headers, which may include the original LLM provider API keys configured in the Flowise environment, effectively facilitating credential theft.\nThe root cause is the lack of server-side validation against a trusted list of domains or protocols, allowing the application to participate in unintended network communications. The impact is significant because the server-side context allows the attacker to interact with resources that are otherwise protected by internal firewalls or VPC boundaries.\nThis vulnerability effectively turns the Flowise instance into an open proxy for the internal network, granting the attacker a foothold to enumerate internal infrastructure or extract configuration secrets stored within the application's environment variables."
}