Server-Side Request Forgery Vulnerability in FlowIntel by FlowIntel
CVE-2026-9813

6.2MEDIUM

Key Information:

Vendor

Flowintel

Status
Flowintel
Vendor
CVE Published:
28 May 2026

What is CVE-2026-9813?

FlowIntel, up to version 3.3.0, exhibits a server-side request forgery (SSRF) vulnerability in its external reference URL probe functionality located in app/case/task.py. This flaw allows attackers who can submit external reference URLs to manipulate the application server into issuing HTTP HEAD requests to arbitrary destinations. Due to a lack of adequate URL scheme validation and destination address resolution, attackers may exploit this vulnerability to access internal services, cloud metadata endpoints, and other network resources that should remain restricted. The potential for unauthorized access to sensitive network components poses significant risks to the integrity of data and application operations.

Affected Version(s)

flowintel 0 < 3.3.0

References

https://github.com/flowintel/flowintel/commit/68b523b4785...
patch

CVSS V4

Score:
6.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bilal Teke
David Cruciani
Alexandre Dulaunoy
Codex (GPT-5.5)
.