CVE-2026-90580

FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.1.3 is able to resolve this issue. The patch is identified as 700137738bcaebefd4709021f6d6b0abcd7df0ac. It is recommended to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.

Analysis

AI-generated

Technical impact

The flaw is in the Evaluations Endpoint, where the Host or X‑Forwarded‑Proto header values supplied by a client are trusted. By crafting these headers to any desired value, a remote attacker can cause the server to send an HTTP request to an arbitrary URL, resulting in a server‑side request forgery (CWE‑918). The vulnerability affects FlowiseAI Flowise products up to version 3.0.2, which are no longer supported. The issue is resolved in Flowise version 3.1.3 and later.

Affected Systems

The affected systems are applications running FlowiseAI Flowise up to and including version 3.0.2, which are currently unsupported by the maintainer. Upgrading to Flowise 3.1.3 or later removes the vulnerable code paths.

Risk and Exploitability

The CVSS score of 5.3 reflects moderate risk. Because the EPSS score is < 1%, and the vulnerability is not listed in KEV. A remote attacker can invoke SSRF via the Evaluations Endpoint by setting Host/X‑Forwarded‑Proto headers, potentially allowing access to internal or external services reachable from the server and possibly exfiltrating data. Updating to 3.1.3 removes the insecure header handling, eliminating the SSRF capability.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Flowise to version 3.1.3 or newer to eliminate the vulnerable code.
  • Restrict the server’s outbound network access operation, limiting the potential impact of SSRF.
  • If the Evaluations Endpoint is not required for your environment, disable it or block incoming requests to that endpoint at the firewall.

Generated by OpenCVE AI on September 15, 2026 at 17:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.1.3 is able to resolve this issue. The patch is identified as 700137738bcaebefd4709021f6d6b0abcd7df0ac. It is recommended to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.
Title FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
First Time appeared Flowiseai
Flowiseai flowise
Weaknesses CWE-918
CPEs cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*
Vendors & Products Flowiseai
Flowiseai flowise
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 16, 2026, 2:14 PM
Reserved
Sep 12, 2026, 4:41 PM

View source JSON

Updated
Sep 16, 2026, 2:14 PM

JSON

Status
Analyzed
Published
Sep 13, 2026, 8:16 PM
Modified
Sep 16, 2026, 3:18 PM

View source JSON

No data.

Updated
Sep 15, 2026, 5:15 PM

JSON