CVE-2026-90580: Flowise SSRF — MEDIUM

CISO Take

Flowise, an open-source low-code platform for building LLM/AI agent workflows, contains a server-side request forgery flaw in its Evaluations endpoint (packages/server/src/controllers/evaluations/index.ts): an authenticated low-privilege user can manipulate the Host and X-Forwarded-Proto headers so the server's axios.post call forges outbound requests to arbitrary internal or cloud-hosted destinations. The CVE description claims a public exploit exists, but our own tracking shows no EPSS score, no CISA KEV listing, and no Nuclei template, so active mass-exploitation is unconfirmed — still, the low bar to exploit (network access, low privileges, no user interaction, CVSS 6.3) makes this worth acting on, especially since Flowise instances are commonly deployed with access to internal networks and cloud metadata services used for agent orchestration. A successful SSRF here could expose cloud IAM credentials (e.g. via AWS/GCP instance metadata) or provide a pivot point into internal infrastructure behind the Flowise deployment. The vendor has fixed this in 3.1.3 (patch 700137738bcaebefd4709021f6d6b0abcd7df0ac); given the description notes the affected range is no longer supported upstream, teams on ≤3.0.2 should upgrade immediately and, as a compensating control, block server egress to link-local/metadata (169.254.169.254) and internal RFC1918 ranges from the Flowise host.

Sources: NVD CISA KEV GitHub Advisory github.com ATLAS

What is the risk?

Medium severity (CVSS 6.3) but low barrier to exploitation: network-reachable, low attack complexity, requires only low privileges and no user interaction. The main constraint on severity is confidentiality/integrity/availability impact rated 'low' individually (C:L/I:L/A:L), reflecting that direct impact is confined to what the SSRF can reach rather than full system compromise. No confirmed EPSS score, no CISA KEV listing, and no Nuclei scanner template were found at analysis time, so real-world exploitation volume cannot be corroborated beyond the vendor/VulDB claim of a public exploit. Risk is elevated in cloud-hosted deployments where SSRF can reach instance metadata services, and in multi-tenant Flowise deployments where the 'low privilege' requirement is trivially met by any registered user.

How does the attack unfold?

Initial Access

An authenticated low-privilege user submits a request to the Flowise Evaluations endpoint with a manipulated Host or X-Forwarded-Proto header.

AML.T0049

SSRF Trigger

The server's axios.post call in the evaluations controller uses the attacker-controlled header to construct its outbound request target instead of a validated destination.

Internal Reconnaissance / Credential Access

The forged request reaches internal services or cloud metadata endpoints, potentially returning sensitive data such as temporary cloud credentials.

AML.T0075

Impact

The attacker exfiltrates the SSRF response (e.g. via evaluation results) and uses any harvested credentials or internal service data to escalate access within the victim's environment.

Initial Access

An authenticated low-privilege user submits a request to the Flowise Evaluations endpoint with a manipulated Host or X-Forwarded-Proto header.

AML.T0049

SSRF Trigger

The server's axios.post call in the evaluations controller uses the attacker-controlled header to construct its outbound request target instead of a validated destination.

Internal Reconnaissance / Credential Access

The forged request reaches internal services or cloud metadata endpoints, potentially returning sensitive data such as temporary cloud credentials.

AML.T0075

Impact

The attacker exfiltrates the SSRF response (e.g. via evaluation results) and uses any harvested credentials or internal service data to escalate access within the victim's environment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

1 step

1) Upgrade to Flowise 3.1.3 or later immediately — this is the primary and only complete fix. 2) If upgrade is not immediately possible, restrict network egress from the Flowise server/container: deny outbound access to 169.254.169.254 (cloud metadata) and internal RFC1918/private ranges, allowing only the specific external hosts Flowise needs (LLM APIs, vector DBs). 3) Review access controls on who can reach the Evaluations endpoint — since PR:L is required, tighten role-based access so only trusted users can create/run evaluations. 4) Monitor outbound request logs from the Flowise server for anomalous Host headers or requests to internal IP ranges/metadata endpoints. 5) Audit any cloud IAM roles attached to the Flowise host and apply least privilege in case credentials were already exposed via metadata service access.

How is it classified?

Data Extraction Privacy Violation Agent API AML.T0049 - Exploit Public-Facing Application AML.T0075 - Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6 - AI system operation and monitoring

NIST AI RMF

MANAGE 2.3 - AI system risks are documented and monitored regularly

Frequently Asked Questions

What is CVE-2026-90580?

Flowise, an open-source low-code platform for building LLM/AI agent workflows, contains a server-side request forgery flaw in its Evaluations endpoint (packages/server/src/controllers/evaluations/index.ts): an authenticated low-privilege user can manipulate the Host and X-Forwarded-Proto headers so the server's axios.post call forges outbound requests to arbitrary internal or cloud-hosted destinations. The CVE description claims a public exploit exists, but our own tracking shows no EPSS score, no CISA KEV listing, and no Nuclei template, so active mass-exploitation is unconfirmed — still, the low bar to exploit (network access, low privileges, no user interaction, CVSS 6.3) makes this worth acting on, especially since Flowise instances are commonly deployed with access to internal networks and cloud metadata services used for agent orchestration. A successful SSRF here could expose cloud IAM credentials (e.g. via AWS/GCP instance metadata) or provide a pivot point into internal infrastructure behind the Flowise deployment. The vendor has fixed this in 3.1.3 (patch 700137738bcaebefd4709021f6d6b0abcd7df0ac); given the description notes the affected range is no longer supported upstream, teams on ≤3.0.2 should upgrade immediately and, as a compensating control, block server egress to link-local/metadata (169.254.169.254) and internal RFC1918 ranges from the Flowise host.

Is CVE-2026-90580 actively exploited?

No confirmed active exploitation of CVE-2026-90580 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-90580?

1) Upgrade to Flowise 3.1.3 or later immediately — this is the primary and only complete fix. 2) If upgrade is not immediately possible, restrict network egress from the Flowise server/container: deny outbound access to 169.254.169.254 (cloud metadata) and internal RFC1918/private ranges, allowing only the specific external hosts Flowise needs (LLM APIs, vector DBs). 3) Review access controls on who can reach the Evaluations endpoint — since PR:L is required, tighten role-based access so only trusted users can create/run evaluations. 4) Monitor outbound request logs from the Flowise server for anomalous Host headers or requests to internal IP ranges/metadata endpoints. 5) Audit any cloud IAM roles attached to the Flowise host and apply least privilege in case credentials were already exposed via metadata service access.

What systems are affected by CVE-2026-90580?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving, RAG pipelines.

What is the CVSS score for CVE-2026-90580?

CVE-2026-90580 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.23%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmodel servingRAG pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0075 Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.1.3 is able to resolve this issue. The patch is identified as 700137738bcaebefd4709021f6d6b0abcd7df0ac. It is recommended to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.

Exploitation Scenario

An adversary who has obtained low-privilege credentials to a Flowise instance (e.g. via a shared internal deployment, a leaked invite, or a weak-signup tenant) submits a request to the Evaluations endpoint with a crafted Host header (or X-Forwarded-Proto) pointing at 169.254.169.254 or an internal service address. The server's axios.post call, trusting the manipulated header instead of a fixed target, issues the outbound request on the attacker's behalf. If the Flowise host runs in AWS/GCP/Azure, the response may include instance metadata containing temporary cloud credentials, which the attacker exfiltrates via the evaluation result and uses to pivot further into the cloud environment. Alternatively, the attacker uses the same mechanism to port-scan or query internal-only APIs and databases that are not directly internet-reachable.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.