5 matches found
CVE-2026-69258
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...
EUVD-2026-10930
Flowise affected by Server-Side Request Forgery SSRF in HTTP Node Leading to Internal Network Access...
CVE-2026-31829 Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including...
Improper Input Validation
flowise is vulnerable to improper input validation. The vulnerability is due to missing validation of chatflowId and chatId parameters, which allows an attacker to access arbitrary files through improper handling of file upload operations...