CVE-2026-67620

HighCVSS 7.7/10Last modified Oct 24, 2026

Description

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticated attackers to force the server to issue arbitrary GET requests to cloud instance metadata services. Attackers can send requests to the fetch-links API endpoint with a crafted URL parameter, bypassing deny-list validation including redirect-based bypasses, to reach instance metadata services and expose instance identity data and role credentials on Oracle Cloud Infrastructure or Alibaba Cloud deployments, with unauthenticated access possible when URL-fetching nodes exist in public chatflows.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Aug 8, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-676217.6Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized doc CVE-2026-676229.9Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authentica CVE-2026-676238.8Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a CVE-2026-676246.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-676258.5Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-676266.5Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network.CVE-2026-676284.9Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-676296.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-67636.5Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thun CVE-2026-676306.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-676319.8Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-676336.5Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.