GHSA-9hrv-gvrv-6gf2: Flowise Execute Flow function has an SSRF vulnerability

April 16, 2026 (updated September 23, 2026)

The attacker provides an intranet address through the base url field configured in the Execute Flow node → Bypass checkDenyList / resolveAndValidate in httpSecurity.ts (not called) → Causes the server to initiate an HTTP request to any internal network address, read cloud metadata, or detect internal network services

References

github.com/FlowiseAI/Flowise/security/advisories/GHSA-9hrv-gvrv-6gf2
github.com/advisories/GHSA-9hrv-gvrv-6gf2
nvd.nist.gov/vuln/detail/CVE-2026-56275
www.vulncheck.com/advisories/flowise-server-side-request-forgery-via-execute-flow-base-url

Code Behaviors & Features

Detect and mitigate GHSA-9hrv-gvrv-6gf2 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →