CVE-2026-127214: Flowise 3.1.4 SSRF Bypass via Custom Function Sandbox
Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with chatflows or agentflows create/update permissions to bypass the Custom Function sandbox's SSRF protection by requiring a module subpath inside an allowlisted package, such as axios/dist/node/axios.cjs or node-fetch/lib/index.js, which evades the vm2 mock table and returns an unwrapped HTTP client that skips the checkDenyList validation. Attackers can issue arbitrary GET and POST requests with attacker-controlled bodies via POST /api/v1/node-custom-function to reach loopback and internal-network addresses or the cloud metadata endpoint, enabling network mapping, credential disclosure, and state changes on internal services.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have permission to create or update chatflows or agentflows. They can then use the custom-function API endpoint to make requests from the Flowise server.
Is interaction from another user required?
No. The vector indicates network access, low attack complexity, no user interaction, and low privileges required.
What access can an attacker obtain through the SSRF?
The attacker can send arbitrary GET and POST requests, including attacker-controlled request bodies, to loopback, internal-network, and cloud metadata addresses. This can enable internal network mapping, credential disclosure, and changes to internal services.
How is the sandbox protection bypassed?
The bypass uses a module subpath within an allowlisted package, such as axios/dist/node/axios.cjs or node-fetch/lib/index.js. This evades the vm2 mock table and provides an HTTP client that does not perform checkDenyList validation.