Description
The core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list.
Recommendation
Update the flowise-components package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.0.13
- Patched version(s): 3.1.0
References
Could your website be exposed too?
SmartScanner can check your website for Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) - CVE-2026-43995
- Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox - CVE-2026-41270
- Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE - CVE-2026-70470
- Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) - CVE-2026-69263
You might also like:
See something that needs correcting? Let us knowUpdated April 24, 2026