CVE-2026-127214: Flowise SSRF sandbox bypass

CISO Take

Flowise through 3.1.4 has a server-side request forgery flaw in its Custom Function sandbox. An authenticated user with chatflow or agentflow create/update rights can require a subpath inside an allowlisted package (such as axios/dist/node/axios.cjs), which skips the SSRF deny-list. That lets them send arbitrary GET and POST requests to loopback, internal networks, and the cloud metadata endpoint. The CVSS score is 8.5 with a changed scope, because the impact reaches beyond Flowise to cloud credentials and internal services. No KEV listing, public exploit, or Nuclei template is known yet, and EPSS is not available. However, a public write-up with the technique details lowers the barrier, and Flowise instances are often exposed with broad builder access. Treat this as a priority for internet-facing or multi-user deployments: upgrade to a fixed release above 3.1.4 once available, enforce IMDSv2 or block metadata access, and restrict egress from Flowise hosts.

Sources:NVDVulnCheckATLAS

What is the risk?

High. Exploitation is network-based, low complexity, and needs only low privileges (chatflow create/update), with no user interaction. Scope is changed, so the blast radius includes cloud metadata credentials and internal services that Flowise can reach. No active exploitation, KEV listing, public exploit code, or scanner template is confirmed, and EPSS is unavailable, but the public technique write-up makes weaponization straightforward. Risk is highest in multi-tenant or shared Flowise deployments, and in those running in cloud environments with permissive instance roles or flat internal networks.

How does the attack unfold?

Initial Access

Attacker uses a low-privilege Flowise account with chatflow or agentflow create/update permissions.

AML.T0012

Sandbox Bypass

Custom Function code requires a package subpath such as axios/dist/node/axios.cjs, which evades the vm2 mock table and the SSRF deny-list.

AML.T0107

Internal Access

Crafted GET and POST requests via POST /api/v1/node-custom-function reach loopback, internal services, and the cloud metadata endpoint.

AML.T0049

Impact

Attacker harvests cloud credentials, maps the internal network, and changes state on internal services.

AML.T0055

Initial Access

Attacker uses a low-privilege Flowise account with chatflow or agentflow create/update permissions.

AML.T0012

Sandbox Bypass

Custom Function code requires a package subpath such as axios/dist/node/axios.cjs, which evades the vm2 mock table and the SSRF deny-list.

AML.T0107

Internal Access

Crafted GET and POST requests via POST /api/v1/node-custom-function reach loopback, internal services, and the cloud metadata endpoint.

AML.T0049

Impact

Attacker harvests cloud credentials, maps the internal network, and changes state on internal services.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

8.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CHigh

ILow

ANone

What should I do?

1 step

1) Upgrade Flowise to a release newer than 3.1.4 that fixes the bypass; check the vendor release notes and the VulnCheck advisory. 2) Until patched, restrict who can create or update chatflows and agentflows, and review recent changes to Custom Function nodes. 3) Enforce IMDSv2 (hop limit 1) or block 169.254.169.254 from the Flowise host or container. 4) Apply egress filtering and network segmentation so Flowise cannot reach internal admin services or loopback-bound management ports. 5) Detect: monitor POST /api/v1/node-custom-function calls and Custom Function code containing require() of axios/dist, node-fetch/lib, or other package subpaths; alert on outbound requests from Flowise to RFC1918, loopback, or link-local addresses. 6) Rotate any credentials reachable from the host if suspicious activity is found.

How is it classified?

Data LeakageAuth BypassFrameworkAgentPluginAML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0075- Cloud Service Discovery AML.T0107- Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Security of AI system components

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks are followed

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-127214?

Flowise through 3.1.4 has a server-side request forgery flaw in its Custom Function sandbox. An authenticated user with chatflow or agentflow create/update rights can require a subpath inside an allowlisted package (such as axios/dist/node/axios.cjs), which skips the SSRF deny-list. That lets them send arbitrary GET and POST requests to loopback, internal networks, and the cloud metadata endpoint. The CVSS score is 8.5 with a changed scope, because the impact reaches beyond Flowise to cloud credentials and internal services. No KEV listing, public exploit, or Nuclei template is known yet, and EPSS is not available. However, a public write-up with the technique details lowers the barrier, and Flowise instances are often exposed with broad builder access. Treat this as a priority for internet-facing or multi-user deployments: upgrade to a fixed release above 3.1.4 once available, enforce IMDSv2 or block metadata access, and restrict egress from Flowise hosts.

Is CVE-2026-127214 actively exploited?

No confirmed active exploitation of CVE-2026-127214 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-127214?

1) Upgrade Flowise to a release newer than 3.1.4 that fixes the bypass; check the vendor release notes and the VulnCheck advisory. 2) Until patched, restrict who can create or update chatflows and agentflows, and review recent changes to Custom Function nodes. 3) Enforce IMDSv2 (hop limit 1) or block 169.254.169.254 from the Flowise host or container. 4) Apply egress filtering and network segmentation so Flowise cannot reach internal admin services or loopback-bound management ports. 5) Detect: monitor POST /api/v1/node-custom-function calls and Custom Function code containing require() of axios/dist, node-fetch/lib, or other package subpaths; alert on outbound requests from Flowise to RFC1918, loopback, or link-local addresses. 6) Rotate any credentials reachable from the host if suspicious activity is found.

What systems are affected by CVE-2026-127214?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code LLM workflow builders, RAG pipelines, cloud-hosted AI orchestration.

What is the CVSS score for CVE-2026-127214?

CVE-2026-127214 has a CVSS v3.1 base score of 8.5 (HIGH).

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code LLM workflow buildersRAG pipelinescloud-hosted AI orchestration

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0075Cloud Service Discovery

AML.T0107Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with chatflows or agentflows create/update permissions to bypass the Custom Function sandbox's SSRF protection by requiring a module subpath inside an allowlisted package, such as axios/dist/node/axios.cjs or node-fetch/lib/index.js, which evades the vm2 mock table and returns an unwrapped HTTP client that skips the checkDenyList validation. Attackers can issue arbitrary GET and POST requests with attacker-controlled bodies via POST /api/v1/node-custom-function to reach loopback and internal-network addresses or the cloud metadata endpoint, enabling network mapping, credential disclosure, and state changes on internal services.

Exploitation Scenario

An attacker obtains a low-privilege Flowise builder account, for example through phished credentials or a shared team workspace. They create a chatflow with a Custom Function node that requires axios/dist/node/axios.cjs, which returns an unwrapped HTTP client that skips the deny-list check. They call POST /api/v1/node-custom-function to request the cloud metadata endpoint and retrieve temporary IAM credentials. They then scan internal hosts and send crafted POST requests to internal services, such as an unauthenticated admin API, and use the stolen credentials to reach storage buckets or vector databases tied to the AI platform.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.