CVE-2026-90580: FlowiseAI Flowise SSRF Vulnerability

CVE-2026-90580 Overview

CVE-2026-90580 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in FlowiseAI Flowise through version 3.0.2. The flaw exists in the axios.post call within packages/server/src/controllers/evaluations/index.ts, part of the Evaluations Endpoint component. Attackers can manipulate the Host and X-Forwarded-Proto HTTP headers to control the base URL used for outbound requests. The issue affects only versions no longer supported by the maintainer, and an exploit has been made public. Upgrading to version 3.1.3 resolves the issue via patch commit 700137738bcaebefd4709021f6d6b0abcd7df0ac.

Critical Impact
Authenticated attackers can coerce the Flowise server into issuing HTTP requests to attacker-controlled destinations, enabling internal network reconnaissance and interaction with services reachable from the server.

Affected Products

FlowiseAI Flowise versions up to and including 3.0.2
Unsupported Flowise releases prior to 3.1.3
Deployments exposing the Evaluations Endpoint over the network

Discovery Timeline

2026-09-13 - CVE-2026-90580 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90580

Vulnerability Analysis

The vulnerability resides in the Evaluations controller of the Flowise server. When creating an evaluation, the controller constructs a baseURL from request-supplied HTTP headers rather than a trusted configuration value. The resulting URL is then passed into an axios.post call executed by the server.

Because the Host and X-Forwarded-Proto headers are attacker-controlled, an authenticated user can redirect the internal request to any host reachable from the Flowise process. This creates a classic SSRF condition where the server is used as a proxy to interact with internal services, metadata endpoints, or third-party systems.

Root Cause

The root cause is trust in unauthenticated request metadata for building server-side URLs. The controller derived httpProtocol from x-forwarded-proto and the host from req.get('host'), both of which travel in the client request. No allowlist or validation was applied before the URL was used in an outbound HTTP call.

Attack Vector

Exploitation requires network access to the Evaluations Endpoint and low-privilege authentication. An attacker sends a crafted request setting Host and X-Forwarded-Proto to point at an internal or external target. Flowise then issues an outbound request to that target, potentially returning data or triggering actions on services that trust the server's origin.

typescript

// Patch: packages/server/src/controllers/evaluations/index.ts
        const body = req.body
        body.workspaceId = workspaceId

-        const httpProtocol = req.get('x-forwarded-proto') || req.get('X-Forwarded-Proto') || req.protocol
-        const baseURL = `${httpProtocol}://${req.get('host')}`
+        const baseURL = `${process.env.APP_URL}`
        const apiResponse = await evaluationsService.createEvaluation(body, baseURL, orgId, workspaceId)
        return res.json(apiResponse)
    } catch (error) {
// Source: https://github.com/FlowiseAI/Flowise/commit/700137738bcaebefd4709021f6d6b0abcd7df0ac

The patch replaces header-derived values with the APP_URL environment variable, removing attacker influence over the base URL.

Detection Methods for CVE-2026-90580

Indicators of Compromise

Inbound requests to /api/v1/evaluations containing unusual Host or X-Forwarded-Proto header values
Outbound HTTP connections from the Flowise process to internal IP ranges, cloud metadata endpoints, or unexpected external hosts
Repeated evaluation creation attempts from a single authenticated session correlated with abnormal egress traffic

Detection Strategies

Inspect reverse proxy and web server logs for Host header values that do not match the Flowise fully qualified domain name
Alert on outbound requests from the Flowise service to RFC1918 addresses or 169.254.169.254
Correlate authenticated Flowise API activity with process-level network telemetry to identify SSRF pivoting

Monitoring Recommendations

Enable request logging on the Evaluations Endpoint including all forwarding headers
Baseline expected egress destinations for the Flowise service and alert on deviations
Track user-agent and source IP patterns for accounts invoking evaluation APIs

How to Mitigate CVE-2026-90580

Immediate Actions Required

Upgrade Flowise to version 3.1.3 or later
Set the APP_URL environment variable to the canonical Flowise base URL before restart
Restrict outbound network access from the Flowise service to only required destinations
Audit existing evaluation records for entries created with unexpected baseURL values

Patch Information

The fix is delivered in Flowise 3.1.3 via commit 700137738bcaebefd4709021f6d6b0abcd7df0ac. Details are available in the FlowiseAI 3.1.3 release notes, the patch commit, and GitHub issue #6687.

Workarounds

Place Flowise behind a reverse proxy that strips or normalizes Host and X-Forwarded-Proto headers from client requests
Apply egress firewall rules preventing the Flowise process from reaching internal services and cloud metadata endpoints
Limit access to the Evaluations Endpoint to trusted authenticated users through network ACLs

bash

# Nginx example: enforce trusted Host and Proto values before proxying to Flowise
server {
    listen 443 ssl;
    server_name flowise.example.com;

    location / {
        proxy_set_header Host flowise.example.com;
        proxy_set_header X-Forwarded-Proto https;
        proxy_pass http://127.0.0.1:3000;
    }
}