CVE-2026-41272

HighCVSS 7.1/10Last modified Oct 26, 2026

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list. This vulnerability is fixed in 3.1.0.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
FlowiseAI	Flowise	< 3.1.0
FlowiseAI	flowise-components	< 3.1.0

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2x8m-83vc-6wv4Exploit, Vendor Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2x8m-83vc-6wv4Exploit, Vendor Advisory

Timeline

Published: Apr 23, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-412738.2Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise contains an authentication CVE-2026-412749.8Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forward CVE-2026-412757.5Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password reset functionality on CVE-2026-412769.8Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, this vulnerability allows remote at CVE-2026-412778.8Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignment vulnerability in CVE-2026-412787.5Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GET /api/v1/public-chatflows/:i CVE-2026-412797.5Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpo CVE-2026-41284.3The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1 CVE-2026-412804.9Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This is CVE-2026-412816.3Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CWE-319) vulnerability CVE-2026-412827.5ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untru CVE-2026-412839.9OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code executi