CVE-2025-59527: Flowise unauthenticated SSRF exposes

CISO Take

Flowise 3.0.5 contains an unauthenticated Server-Side Request Forgery in its /api/v1/fetch-links endpoint, enabling any network-accessible attacker to coerce the Flowise server into proxying HTTP requests to internal services and returning their content. Flowise deployments are typically positioned inside enterprise networks with broad access to internal APIs, vector databases, LLM gateways, and cloud infrastructure — making SSRF here significantly more dangerous than in a generic web application. A public PoC exists, exploitation requires zero privileges and zero user interaction (CVSS AV:N/AC:L/PR:N/UI:N), and the package carries 16 prior CVEs indicating a persistent pattern of insufficient security review. Patch to Flowise 3.0.6 immediately; if patching is blocked, restrict /api/v1/fetch-links at the reverse proxy layer and audit outbound HTTP logs for requests targeting RFC1918 ranges or cloud metadata endpoints such as 169.254.169.254.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High risk. Zero-authentication network exploitation with a public PoC lowers the attacker skill floor to near-zero. Flowise is commonly deployed with internal network access to LLM APIs, vector stores, and backend services, making SSRF a pivot point into broader AI infrastructure. Cloud deployments face additional exposure from metadata endpoint abuse (AWS IMDSv1, GCP metadata server) that could yield temporary IAM credentials enabling full cloud account compromise. The 16 prior CVEs in this package signal a systemic vulnerability management gap that warrants elevated scrutiny.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

5.5%

chance of exploitation in 30 days

Higher than 93% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

6 steps

Patch immediately: upgrade to Flowise 3.0.6.
If patching is delayed, block or rate-limit the /api/v1/fetch-links endpoint at the WAF or reverse proxy with an explicit deny rule.
Implement outbound egress controls for Flowise containers — restrict outbound HTTP to a specific allowlist of required external domains.
In cloud environments, enforce IMDSv2 with hop-limit=1 on EC2/GCP instances to block metadata SSRF.
Audit access logs for anomalous outbound requests to 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.169.254.
Network-segment Flowise deployments so they cannot directly reach production databases, secrets stores, or other sensitive internal services.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionPrivacy ViolationAgentFrameworkAML.T0006- Active Scanning AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

8.2-AI risk assessment

NIST AI RMF

MANAGE-2.2-Mechanisms to sustain value and mitigate AI risks of deployed systems

OWASP LLM Top 10

LLM08-Excessive Agency

Frequently Asked Questions

What is CVE-2025-59527?

Flowise 3.0.5 contains an unauthenticated Server-Side Request Forgery in its /api/v1/fetch-links endpoint, enabling any network-accessible attacker to coerce the Flowise server into proxying HTTP requests to internal services and returning their content. Flowise deployments are typically positioned inside enterprise networks with broad access to internal APIs, vector databases, LLM gateways, and cloud infrastructure — making SSRF here significantly more dangerous than in a generic web application. A public PoC exists, exploitation requires zero privileges and zero user interaction (CVSS AV:N/AC:L/PR:N/UI:N), and the package carries 16 prior CVEs indicating a persistent pattern of insufficient security review. Patch to Flowise 3.0.6 immediately; if patching is blocked, restrict /api/v1/fetch-links at the reverse proxy layer and audit outbound HTTP logs for requests targeting RFC1918 ranges or cloud metadata endpoints such as 169.254.169.254.

Is CVE-2025-59527 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-59527, increasing the risk of exploitation.

How to fix CVE-2025-59527?

1. Patch immediately: upgrade to Flowise 3.0.6. 2. If patching is delayed, block or rate-limit the /api/v1/fetch-links endpoint at the WAF or reverse proxy with an explicit deny rule. 3. Implement outbound egress controls for Flowise containers — restrict outbound HTTP to a specific allowlist of required external domains. 4. In cloud environments, enforce IMDSv2 with hop-limit=1 on EC2/GCP instances to block metadata SSRF. 5. Audit access logs for anomalous outbound requests to 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.169.254. 6. Network-segment Flowise deployments so they cannot directly reach production databases, secrets stores, or other sensitive internal services.

What systems are affected by CVE-2025-59527?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration platforms, cloud-deployed AI infrastructure, internal AI services mesh.

What is the CVSS score for CVE-2025-59527?

CVE-2025-59527 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 5.46%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration platformscloud-deployed AI infrastructureinternal AI services mesh

MITRE ATLAS Techniques

AML.T0006Active Scanning

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.2

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery (SSRF) vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise server as a proxy to access internal network web services and explore their link structures. This issue has been patched in version 3.0.6.

Exploitation Scenario

An attacker discovers a Flowise instance exposed on a corporate or cloud network — common in AI/ML teams using Flowise for LLM workflow prototyping. Without any credentials, they send a request to /api/v1/fetch-links with the URL parameter targeting http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDS) or an internal service such as http://internal-vector-db:6333/collections. Flowise fetches the URL and returns the response body directly, yielding AWS temporary IAM credentials or internal service enumeration data. With cloud credentials in hand, the attacker escalates to full AWS account access, potentially exfiltrating training datasets, model weights, and customer data from S3 or RDS backing the AI platform.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.