{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-31829", "tracking": { "current_release_date": "2026-03-23T11:02:42.016713Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-31829", "initial_release_date": "2026-03-10T22:26:23.681537Z", "revision_history": [ { "date": "2026-03-10T22:26:23.681537Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)." }, { "date": "2026-03-10T22:26:26.267033Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-10T22:38:46.041738Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| References created (1).| CWES updated (1)." }, { "date": "2026-03-10T22:38:47.602347Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-03-11T00:53:16.717246Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-03-11T00:53:20.785072Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-03-11T06:39:56.176456Z", "number": "7", "summary": "References created (1)." }, { "date": "2026-03-11T10:15:39.486754Z", "number": "8", "summary": "Source created.| CVE status created. (valid)| Products connected (1).| References created (4)." }, { "date": "2026-03-11T10:15:42.081467Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-03-11T14:44:56.561058Z", "number": "10", "summary": "Products connected (1).| Product Identifiers created (1).| Exploits created (1)." }, { "date": "2026-03-11T14:45:01.829439Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-03-11T14:54:32.253240Z", "number": "12", "summary": "Source created.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-11T14:54:44.174531Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-03-11T15:40:02.948243Z", "number": "14", "summary": "Unknown change." }, { "date": "2026-03-19T15:29:35.328328Z", "number": "15", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-03-19T15:29:37.894203Z", "number": "16", "summary": "NCSC Score updated." }, { "date": "2026-03-20T09:32:44.874597Z", "number": "17", "summary": "Source connected.| CVE status created. (valid)| EPSS created." } ], "status": "interim", "version": "17" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<3.0.13", "product": { "name": "vers:unknown/<3.0.13", "product_id": "CSAFPID-5768607", "product_identification_helper": { "cpe": "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Flowise" } ], "category": "vendor", "name": "FlowiseAI" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<3.0.13", "product": { "name": "vers:unknown/<3.0.13", "product_id": "CSAFPID-5766734" } } ], "category": "product_name", "name": "Flowise" } ], "category": "vendor", "name": "Open Source" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-31829", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "description", "text": "Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet. This vulnerability is fixed in 3.0.13.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-31829" }, { "category": "description", "text": "Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet. This vulnerability is fixed in 3.0.13.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-31829" }, { "category": "description", "text": "**Description:**\nFlowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints.\nThis enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet.\n\n**Impact includes:**\n- Access to internal admin panels (e.g., internal company dashboards, Jenkins, Kubernetes API, etc.).\n- Retrieval of cloud provider metadata (e.g., AWS IMDSv1 at [http://169.254.169.254], GCP, Azure).\n- Port scanning and enumeration of internal services.\n- Potential lateral movement or privilege escalation in compromised environments.\n\nThis vulnerability is particularly severe because:\n- Flowise instances are often deployed publicly without authentication (FLOWISE_USERNAME/PASSWORD not set by default).\n- The HTTP Node is easily accessible in simple flows with minimal configuration.\n\n**Proof of Concept (PoC):**\nA minimal flow consisting of three nodes demonstrates successful internal network access:\nFlow Structure:\n\"image\"\nHTTP Node Configuration:\nThe HTTP Node is configured to perform a GET request to an internal address on localhost:\nURL: http://127.0.0.1:8000 (or any internal service)\n\"image\"\n\nSuccessful Response from Internal Service:\nWhen the flow is triggered via chat input, the Flowise server successfully retrieves and returns content from the internal mock server running on port 8000 within the same container/network:\n\"image\"\n\n\n**Impact**\nThis is a Server-Side Request Forgery (SSRF) vulnerability with both read and write capabilities.\nThe HTTP Request node supports all standard HTTP methods (GET, POST, PUT, PATCH, DELETE), allowing attackers to not only retrieve sensitive information but also modify, create, or delete data on internal services if those services expose mutable endpoints:\n- Read access: Retrieval of sensitive internal data, cloud provider metadata (e.g., AWS IAM credentials at http://169.254.169.254/latest/meta-data/iam/security-credentials/), secrets, configuration files, or database contents.\n- Write access: Modification or deletion of internal resources via POST/PUT/PATCH/DELETE methods (e.g., creating malicious users/configurations, overwriting files, deleting data, triggering destructive actions on internal admin panels, CI/CD systems like Jenkins, Kubernetes APIs, or cloud management interfaces).\nAmplification: Retrieved cloud credentials can be used for further privilege escalation or lateral movement outside the n8n instance.\n\n\nSuggested Long-term Fix (for Flowise):\n- Add optional security controls to HTTP Node:\n- Toggle: \"Block private IP ranges and localhost\" (enabled by default).\n- Field: \"Allowed domains\" (whitelist).\n- Display prominent warning when URL field uses template variables (e.g., {{ }}).\n- Update documentation with explicit SSRF risks and best practices.", "title": "github - https://github.com/advisories/GHSA-fvcw-9w9r-pxc7" }, { "category": "description", "text": "**Description:**\nFlowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints.\nThis enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet.\n\n**Impact includes:**\n- Access to internal admin panels (e.g., internal company dashboards, Jenkins, Kubernetes API, etc.).\n- Retrieval of cloud provider metadata (e.g., AWS IMDSv1 at [http://169.254.169.254], GCP, Azure).\n- Port scanning and enumeration of internal services.\n- Potential lateral movement or privilege escalation in compromised environments.\n\nThis vulnerability is particularly severe because:\n- Flowise instances are often deployed publicly without authentication (FLOWISE_USERNAME/PASSWORD not set by default).\n- The HTTP Node is easily accessible in simple flows with minimal configuration.\n\n**Proof of Concept (PoC):**\nA minimal flow consisting of three nodes demonstrates successful internal network access:\nFlow Structure:\n\"image\"\nHTTP Node Configuration:\nThe HTTP Node is configured to perform a GET request to an internal address on localhost:\nURL: http://127.0.0.1:8000 (or any internal service)\n\"image\"\n\nSuccessful Response from Internal Service:\nWhen the flow is triggered via chat input, the Flowise server successfully retrieves and returns content from the internal mock server running on port 8000 within the same container/network:\n\"image\"\n\n\n**Impact**\nThis is a Server-Side Request Forgery (SSRF) vulnerability with both read and write capabilities.\nThe HTTP Request node supports all standard HTTP methods (GET, POST, PUT, PATCH, DELETE), allowing attackers to not only retrieve sensitive information but also modify, create, or delete data on internal services if those services expose mutable endpoints:\n- Read access: Retrieval of sensitive internal data, cloud provider metadata (e.g., AWS IAM credentials at http://169.254.169.254/latest/meta-data/iam/security-credentials/), secrets, configuration files, or database contents.\n- Write access: Modification or deletion of internal resources via POST/PUT/PATCH/DELETE methods (e.g., creating malicious users/configurations, overwriting files, deleting data, triggering destructive actions on internal admin panels, CI/CD systems like Jenkins, Kubernetes APIs, or cloud management interfaces).\nAmplification: Retrieved cloud credentials can be used for further privilege escalation or lateral movement outside the n8n instance.\n\n\nSuggested Long-term Fix (for Flowise):\n- Add optional security controls to HTTP Node:\n- Toggle: \"Block private IP ranges and localhost\" (enabled by default).\n- Field: \"Allowed domains\" (whitelist).\n- Display prominent warning when URL field uses template variables (e.g., {{ }}).\n- Update documentation with explicit SSRF risks and best practices.", "title": "github - https://api.github.com/advisories/GHSA-fvcw-9w9r-pxc7" }, { "category": "other", "text": "0.00049", "title": "EPSS" }, { "category": "other", "text": "3.9", "title": "NCSC Score" }, { "category": "other", "text": "There is product data available from source Certbundde", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "There is exploit data available from source Nvd, Is related to (a version of) an uncommon product", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5768607", "CSAFPID-5766734" ] }, "references": [ { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31829" }, { "category": "external", "summary": "Source raw - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-31829" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31829" }, { "category": "external", "summary": "Source raw - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/31xxx/CVE-2026-31829.json" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-fvcw-9w9r-pxc7" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-fvcw-9w9r-pxc7" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0689.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-31829" }, { "category": "external", "summary": "Source raw - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-fvcw-9w9r-pxc7" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd", "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fvcw-9w9r-pxc7" }, { "category": "external", "summary": "Reference - certbundde; github", "url": "https://github.com/advisories/GHSA-fvcw-9w9r-pxc7" }, { "category": "external", "summary": "Reference - github", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31829" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0689.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0689" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31829" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-5766734", "CSAFPID-5768607" ] } ], "title": "CVE-2026-31829" } ] }