Server-Side Request Forgery Vulnerability in Flowise by FlowiseAI
CVE-2026-41271

7.1HIGH

Key Information:

Vendor

Flowiseai

Status
Flowise
Flowise-components
Vendor
CVE Published:
23 April 2026

What is CVE-2026-41271?

Flowise, a user-friendly framework for designing customized large language model workflows, is affected by a Server-Side Request Forgery vulnerability in its API Chain components. This flaw allows attackers without authentication to manipulate the server into making unapproved HTTP requests. By exploiting this vulnerability, malicious actors can inject harmful prompt templates, circumventing API documentation restrictions and gaining access to sensitive internal systems. The consequence can lead to network reconnaissance and potential data breaches. A fix for this issue is implemented in version 3.1.0.

Affected Version(s)

Flowise < 3.1.0

flowise-components < 3.1.0

References

https://github.com/FlowiseAI/Flowise/security/advisories/...
x_refsource_CONFIRM

CVSS V3.0

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.