---
id: "CVE-2026-127214"
page: "https://infrastack.ai/live/CVE-2026-127214"
kind: "vulnerability"
aliases: ["CVE-2026-127214"]
title: "Flowise: custom function sandbox lets authenticated users reach internal network"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "flowise", "fixed": [], "affected": "<= 3.1.4", "ecosystem": "npm"}]
ecosystems: []
tags: ["ai-agents", "ai-tooling", "cloud-metadata", "flowise", "self-hosted", "ssrf"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-11-13T20:18:55+00:00"
first_seen_at: "2026-11-13T21:27:23+00:00"
updated_at: "2026-11-13T21:30:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127214", "first_seen_at": "2026-11-13T21:27:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-13T21:30:18+00:00"}]
exploit_sources: []
---

# Flowise: custom function sandbox lets authenticated users reach internal network

Link for people: https://infrastack.ai/live/CVE-2026-127214 (this .md is for agents)

Flowise, an AI agent builder, has a server-side request forgery flaw in its Custom Function sandbox. An authenticated user with chatflow or agentflow create/update rights can send arbitrary GET and POST requests from the server to internal addresses and cloud metadata endpoints, exposing credentials and enabling changes to internal services.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:flowise affected <= 3.1.4 fixed no fixed version listed

## How to check

Run 'npm ls flowise' or read package.json/docker image tag: versions <= 3.1.4 are in the stated range (VulnCheck; no vendor advisory found). Review which users hold chatflows/agentflows create or update rights, and whether the server can reach 169.254.169.254 or internal hosts. Check whether POST /api/v1/node-custom-function is reachable by those users.

## Timeline

- 2026-11-13T21:27:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127214
- 2026-11-13T21:30:18+00:00 analyst — Only third-party advisory (VulnCheck, credit soovwv) states affected <= 3.1.4; no vendor GHSA/fix found, GitHub releases page lists 3.1.4 (29 Jul) as newest. Earlier Flowise SSRF GHSAs (3.1.0, 3.1.4) are different issues. Fix unknown. Severity left; VulnCheck CVSS4 6.3 vs NVD-side 8.5 differ.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/flowise-ssrf-bypass-via-custom-function-sandbox

## From the sources

Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with chatflows or agentflows create/update permissions to bypass the Custom Function sandbox's SSRF protection by requiring a module subpath inside an allowlisted package, such as axios/dist/node/axios.cjs or node-fetch/lib/index.js, which evades the vm2 mock table and returns an unwrapped HTTP client that skips the checkDenyList validation. Attackers can issue arbitrary GET and POST requests with attacker-controlled bodies via POST /api/v1/node-custom-function to reach loopback and internal-network addresses or the cloud metadata endpoint, enabling network mapping, credential disclosure, and state changes on internal services.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_