CVE-2026-4215: FlowCI flow-core-x SSRF Vulnerability

CVE-2026-4215 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been discovered in FlowCI flow-core-x up to version 1.23.01. The vulnerability exists in the Save function within the file core/src/main/java/com/flowci/core/config/service/ConfigServiceImpl.java, specifically in the SMTP Host Handler component. This flaw allows attackers to manipulate server-side requests, potentially enabling unauthorized access to internal resources and services.

Critical Impact

Remote attackers with low privileges can exploit this SSRF vulnerability to force the server to make arbitrary HTTP requests to internal or external systems, potentially bypassing network security controls and accessing sensitive internal services.

Affected Products

• FlowCI flow-core-x version 1.23.01 and earlier

Discovery Timeline

• March 16, 2026 - CVE-2026-4215 published to NVD
• March 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4215

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery), which occurs when an application can be induced to make HTTP requests to an arbitrary domain specified by the attacker. In the context of FlowCI flow-core-x, the SMTP Host Handler component fails to properly validate or sanitize user-supplied input when configuring SMTP host settings.

The vulnerable code path allows authenticated users to specify arbitrary host values that the server will subsequently attempt to connect to. This can be leveraged to probe internal network infrastructure, access cloud metadata services, or interact with other internal services that should not be externally accessible.

The exploit has been publicly released, increasing the risk of active exploitation. The vendor was contacted regarding this vulnerability but did not respond.

Root Cause

The root cause lies in insufficient input validation within the Save function of ConfigServiceImpl.java. When processing SMTP configuration data, the application accepts user-controlled host values without proper validation, allowing attackers to inject internal URLs or IP addresses. The absence of allowlisting for valid SMTP hosts or blocking of internal IP ranges enables this SSRF attack vector.

Attack Vector

The attack is network-based and can be executed remotely by an authenticated user with low privileges. The attacker crafts a malicious SMTP configuration request containing an internal URL or IP address as the SMTP host. When the application processes this configuration, it attempts to establish a connection to the attacker-specified address.

This vulnerability can be exploited to:

• Scan internal network ports and services
• Access cloud instance metadata endpoints (e.g., AWS, GCP, Azure metadata services)
• Interact with internal APIs and services
• Exfiltrate sensitive data from internal systems
• Potentially pivot to other internal systems

For technical details on the exploitation mechanism, refer to the GitHub Bug Report containing the public disclosure.

Detection Methods for CVE-2026-4215

Indicators of Compromise

• Unusual outbound HTTP/HTTPS connections from the FlowCI application server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
• HTTP requests to cloud metadata endpoints (e.g., 169.254.169.254)
• SMTP configuration entries containing non-standard hostnames or internal IP addresses
• Unexpected connection attempts to localhost or loopback addresses from the application

Detection Strategies

• Monitor network traffic from FlowCI servers for connections to internal IP ranges that deviate from normal SMTP traffic patterns
• Implement application-level logging to capture all SMTP configuration changes and review for suspicious host entries
• Deploy network segmentation rules and alert on violations when FlowCI attempts to access restricted internal services
• Review SMTP configuration audit logs for entries containing internal IPs, localhost references, or cloud metadata URLs

Monitoring Recommendations

• Configure SIEM alerts for outbound connections from FlowCI servers to RFC1918 private IP address space
• Enable verbose logging for the ConfigServiceImpl class to capture all configuration save operations
• Implement egress filtering and monitor for blocked connection attempts that may indicate exploitation attempts
• Regularly audit SMTP configurations stored in the FlowCI database for anomalous entries

How to Mitigate CVE-2026-4215

Immediate Actions Required

• Restrict network access to the FlowCI application to trusted users and networks only
• Implement network-level egress filtering to prevent the FlowCI server from connecting to internal services
• Review existing SMTP configurations for any suspicious or unauthorized entries
• Consider disabling SMTP configuration functionality until a patch is available

Patch Information

At the time of publication, no official patch has been released by the vendor. The vendor was contacted early about this disclosure but did not respond. Users should monitor the VulDB entry and the official FlowCI repository for any security updates.

Workarounds

• Implement a Web Application Firewall (WAF) rule to validate SMTP host parameters and block requests containing internal IP addresses
• Deploy network segmentation to isolate the FlowCI application server from sensitive internal services
• Use a reverse proxy to filter and validate SMTP configuration requests before they reach the application
• Restrict the Save function access to administrator-only roles to minimize the attack surface

# Example iptables rules to restrict FlowCI server egress to internal networks
# Block connections to common internal ranges from FlowCI server
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 169.254.169.254 -j DROP