CVE-2026-41271 - Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

Back Back to CVE browser

HIGH

Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

Published Apr 23, 2026

8.3

HIGH

CVSS 3.1

EPSS 0.34%

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems. By injecting malicious prompt templates, attackers can bypass the intended API documentation constraints and redirect requests to sensitive internal services, potentially leading to internal network reconnaissance and data exfiltration. This vulnerability is fixed in 3.1.0.

Affected products

Vendor FlowiseAI Product Flowise Default
n/a
- Version
  < 3.1.0
  Status
  affected
  Constraints
  -
Vendor FlowiseAI Product Flowise-Components Default
n/a
- Version
  < 3.1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FlowiseAI

Flowise

n/a

Version	Status	Constraints
< 3.1.0	affected	-

FlowiseAI

Flowise-Components

n/a

Version	Status	Constraints
< 3.1.0	affected	-

Ecosystem	Package	Introduced	Fixed
npm	flowise	0	3.1.0
npm	flowise-components	0	3.1.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25288
Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6r77-hqx7-7vw8
exploitx_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-6r77-hqx7-7vw8
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41271

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25288		Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6r77-hqx7-7vw8		exploitx_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-6r77-hqx7-7vw8		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41271