{"id":"CVE-2026-127214","kind":"vulnerability","aliases":["CVE-2026-127214"],"related":[],"title":"Flowise: custom function sandbox lets authenticated users reach internal network","description":"Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with chatflows or agentflows create/update permissions to bypass the Custom Function sandbox's SSRF protection by requiring a module subpath inside an allowlisted package, such as axios/dist/node/axios.cjs or node-fetch/lib/index.js, which evades the vm2 mock table and returns an unwrapped HTTP client that skips the checkDenyList validation. Attackers can issue arbitrary GET and POST requests with attacker-controlled bodies via POST /api/v1/node-custom-function to reach loopback and internal-network addresses or the cloud metadata endpoint, enabling network mapping, credential disclosure, and state changes on internal services.","summary":"Flowise, an AI agent builder, has a server-side request forgery flaw in its Custom Function sandbox. An authenticated user with chatflow or agentflow create/update rights can send arbitrary GET and POST requests from the server to internal addresses and cloud metadata endpoints, exposing credentials and enabling changes to internal services.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"flowise","fixed":[],"affected":"<= 3.1.4","ecosystem":"npm"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","cloud-metadata","flowise","self-hosted","ssrf"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Run 'npm ls flowise' or read package.json/docker image tag: versions <= 3.1.4 are in the stated range (VulnCheck; no vendor advisory found). Review which users hold chatflows/agentflows create or update rights, and whether the server can reach 169.254.169.254 or internal hosts. Check whether POST /api/v1/node-custom-function is reachable by those users.","fix":null,"status":"open","published_at":"2026-11-13T20:18:55+00:00","first_seen_at":"2026-11-13T21:27:23+00:00","triaged_at":"2026-11-13T21:29:32+00:00","updated_at":"2026-11-13T21:30:18+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-13T21:29:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Flowise: custom function sandbox lets authenticated users reach internal network","impact":"high","summary":"Flowise, an AI agent builder, has a server-side request forgery flaw in its Custom Function sandbox. An authenticated user with chatflow or agentflow create/update rights can send arbitrary GET and POST requests from the server to internal addresses and cloud metadata endpoints, exposing credentials and enabling changes to internal services.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["flowise","self-hosted","cloud-metadata","ai-agents"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"server requests reach internal services and cloud credentials leak","analyst_note":"Find the fixed Flowise version and vendor advisory; the vulncheck advisory linked in the sources may state it.","how_to_check":"- Check the installed Flowise version (`flowise --version` or the package.json of the deployed app) against the affected range through 3.1.4.\n- Look for users with chatflows or agentflows create/update permissions.\n- Confirm whether the Custom Function node is reachable through `POST /api/v1/node-custom-function`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required","managed-hosting"],"who_is_affected":"Flowise deployments through 3.1.4 where users can create or edit chatflows or agentflows. The attacker needs an authenticated account with those permissions, and the server must be able to reach internal networks or cloud metadata endpoints. Instances restricted to trusted users with no access to internal services carry less risk. The sources do not state a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000789,"input_tokens":4732,"output_tokens":631,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed Flowise version and vendor advisory; the vulncheck advisory linked in the sources may state it.","search":"'-127214':13A,16A '-2026':12A,15A '/api/v1/node-custom-function':163C '/lib/index.js':130C '3.1.4':86C 'address':71B,171C 'agent':20B,35B 'agentflow':56B,102C 'ai':19B,22B,34B 'ai-ag':18B 'ai-tool':21B 'allow':96C 'allowlist':121C 'arbitrari':61B,151C 'attack':98C,148C,158C 'attacker-control':157C 'authent':6A,51B,97C 'axios/dist/node/axios.cjs':125C 'bodi':160C 'builder':36B 'bypass':106C 'chang':80B,184C 'chatflow':54B,100C 'checkdenylist':146C 'client':142C 'cloud':25B,73B,174C 'cloud-metadata':24B 'contain':87C 'control':159C 'create/update':57B,103C 'credenti':77B,180C 'custom':2A,47B,108C 'cve':11A,14A 'disclosur':181C 'enabl':79B,177C 'endpoint':75B,176C 'evad':132C 'expos':76B 'fetch':129C 'flaw':44B 'flowis':1A,27B,32B,84C 'flowise':17A 'forgeri':43B,93C 'function':3A,48B,109C 'get':62B,152C 'host':30B 'http':141C 'insid':119C 'intern':9A,70B,82B,169C,186C 'internal-network':168C 'issu':150C 'let':5A 'loopback':166C 'map':179C 'metadata':26B,74B,175C 'mock':135C 'modul':117C 'network':10A,170C,178C 'node':128C 'node-fetch':127C 'packag':122C 'permiss':104C 'post':64B,154C,162C 'protect':113C 'reach':8A,165C 'request':42B,65B,92C,155C 'requir':115C 'return':138C 'right':58B 'sandbox':4A,49B,110C 'self':29B 'self-host':28B 'send':60B 'server':40B,68B,90C 'server-sid':39B,89C 'servic':83B,187C 'side':41B,91C 'skip':144C 'ssrf':31B,112C 'state':183C 'subpath':118C 'tabl':136C 'tool':23B 'unwrap':140C 'user':7A,52B 'valid':147C 'via':161C 'vm2':134C 'vulner':94C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Flowise up to 3.1.4 where any authenticated user can create or update chatflows or agentflows. Through the Custom Function node they can make the server send GET/POST requests to loopback, internal addresses or cloud metadata, so look at instances running on cloud VMs or inside private networks. Instances with only trusted admins, or no route to internal services, carry little extra risk. No fixed version is published yet; check the Flowise releases page and GitHub security advisories.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["flowise"],"ptokens":["flowise"],"labels":["aiagents","aitooling","cloudmetadata","flowise","high","selfhosted","ssrf"],"campaign_type":null,"search_a":"'-127214':13A,16A '-2026':12A,15A 'authent':6A 'custom':2A 'cve':11A,14A 'flowis':1A 'flowise':17A 'function':3A 'intern':9A 'let':5A 'network':10A 'reach':8A 'sandbox':4A 'user':7A","search_b":"'address':71B 'agent':20B,35B 'agentflow':56B 'ai':19B,22B,34B 'ai-ag':18B 'ai-tool':21B 'arbitrari':61B 'authent':51B 'builder':36B 'chang':80B 'chatflow':54B 'cloud':25B,73B 'cloud-metadata':24B 'create/update':57B 'credenti':77B 'custom':47B 'enabl':79B 'endpoint':75B 'expos':76B 'flaw':44B 'flowis':27B,32B 'forgeri':43B 'function':48B 'get':62B 'host':30B 'intern':70B,82B 'metadata':26B,74B 'post':64B 'request':42B,65B 'right':58B 'sandbox':49B 'self':29B 'self-host':28B 'send':60B 'server':40B,68B 'server-sid':39B 'servic':83B 'side':41B 'ssrf':31B 'tool':23B 'user':52B","search_c":"'/api/v1/node-custom-function':163C '/lib/index.js':130C '3.1.4':86C 'address':171C 'agentflow':102C 'allow':96C 'allowlist':121C 'arbitrari':151C 'attack':98C,148C,158C 'attacker-control':157C 'authent':97C 'axios/dist/node/axios.cjs':125C 'bodi':160C 'bypass':106C 'chang':184C 'chatflow':100C 'checkdenylist':146C 'client':142C 'cloud':174C 'contain':87C 'control':159C 'create/update':103C 'credenti':180C 'custom':108C 'disclosur':181C 'enabl':177C 'endpoint':176C 'evad':132C 'fetch':129C 'flowis':84C 'forgeri':93C 'function':109C 'get':152C 'http':141C 'insid':119C 'intern':169C,186C 'internal-network':168C 'issu':150C 'loopback':166C 'map':179C 'metadata':175C 'mock':135C 'modul':117C 'network':170C,178C 'node':128C 'node-fetch':127C 'packag':122C 'permiss':104C 'post':154C,162C 'protect':113C 'reach':165C 'request':92C,155C 'requir':115C 'return':138C 'sandbox':110C 'server':90C 'server-sid':89C 'servic':187C 'side':91C 'skip':144C 'ssrf':112C 'state':183C 'subpath':118C 'tabl':136C 'unwrap':140C 'valid':147C 'via':161C 'vm2':134C 'vulner':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T20:18:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127214","severity":null,"published_at":"2026-11-13T20:18:55+00:00","modified_at":"2026-11-13T20:18:55+00:00","first_seen_at":"2026-11-13T21:27:23+00:00","fetched_at":"2026-11-13T21:27:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127214:3933","url":null,"severity":null,"published_at":"2026-11-13T21:30:18+00:00","modified_at":"2026-11-13T21:30:18+00:00","first_seen_at":"2026-11-13T21:30:18+00:00","fetched_at":"2026-11-13T21:30:18+00:00","note":"Only third-party advisory (VulnCheck, credit soovwv) states affected <= 3.1.4; no vendor GHSA/fix found, GitHub releases page lists 3.1.4 (29 Jul) as newest. Earlier Flowise SSRF GHSAs (3.1.0, 3.1.4) are different issues. Fix unknown. Severity left; VulnCheck CVSS4 6.3 vs NVD-side 8.5 differ."}],"documents":[{"id":149709,"url":"https://www.vulncheck.com/advisories/flowise-ssrf-bypass-via-custom-function-sandbox","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}