Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access

Description: Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges RFC 1918, localhost, or cloud metadata endpoints. This enables...

CVE-2026-31829

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including...

CVE-2026-25631

n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain validation allowed an authenticated attacker to send requests with credentials to unintended domains, potentially leading to credential exfiltration. This on...

CVE-2026-25631

The CVE-2026-25631 entry concerns n8n’s HTTP Request node credential domain validation. The vulnerability allows an authenticated attacker to send requests with credentials to unintended domains, potentially exfiltrating credentials. It specifically affects users with wildcard domain patterns lik...

CVE-2026-25631 Domain allowlist bypass enables credential exfiltration

n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain validation allowed an authenticated attacker to send requests with credentials to unintended domains, potentially leading to credential exfiltration. This on...

n8n 输入验证错误漏洞

n8n is an open-source, scalable workflow automation tool developed by n8n. Prior to version 1.121.0, there was a vulnerability related to input validation errors in n8n. This vulnerability stemmed from improper validation of credentials in the HTTP Request node, allowing authenticated attackers t...