Flowise’s HTTP Node in AgentFlow and Chatflow accepts user‑supplied URLs for outbound requests without restrictions on target hosts. This flaw allows an attacker who can input a URL to coerce the Flowise server into requesting arbitrary internal resources, such as localhost IPs, private addresses or cloud metadata services. Successful exploitation could expose sensitive internal services, leak data, or serve as a pivot for further attacks, representing a significant confidentiality and integrity risk for any environment where Flowise is publicly reachable.

The vulnerability affects Flowise products from FlowiseAI, any deployment employing Flowise versions older than 3.0.13. Versions starting with 3.0.13 contain the fix that enforces host restrictions.

The CVSS score of 7.1 labels the flaw as high severity, yet the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild so far. The flaw has not entered the CISA Known Exploited Vulnerabilities catalog. Attackers would need only ability to inject a crafted URL into a chatflow or agent flow exposed to the public internet; no privileged credentials are required. In typical usage, the SSRF could be triggered by a simple crafted message, making the vulnerability straightforward to exploit for a motivated attacker.