Flowise versions up to 3.1.4 contain a server‑side request forgery flaw in the httpSecurity.ts component. The SSRF guard’s default deny list does not block the Oracle Cloud Infrastructure metadata endpoint (192.0.0.192) or the Alibaba Cloud metadata endpoint (100.100.100.200). An attacker who can submit a crafted URL to the fetch‑links API, even by temporarily bypassing denial‑list validation or redirect handling, can force the Flowise server to perform arbitrary GET requests to these cloud metadata services. The result is disclosure of instance identity information and, where available, temporary role credentials that may be exploitable to further permissions escalation or data exfiltration. If the Flowise deployment exposes URL‑fetching nodes in public chatflows, even unauthenticated users may leverage the flaw.

FlowiseAI’s Flowise platform, any instance running version 3.1.4 or earlier, supports the vulnerable fetch‑links endpoint. Systems that host public chatflows with URL‑fetching nodes are at heightened risk.

The CVSS score of 6.3 indicates a medium severity with potential for significant data exposure but without direct code execution. The EPSS score is not available; therefore, current exploitation probability remains unclear. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending an authenticated request to the fetch‑links endpoint, substituting a URL that points to 192.0.0.192 or 100.100.100.200 or by mimicking a redirect to bypass the deny list. Publicly exposed Flowise deployments may allow unauthenticated exploitation if they publish URL‑fetching nodes. Containing the exploitation requires configuring the SSRF guard, restricting outbound traffic to metadata services, or applying a patch.