Flowise SSRF leaks cloud credentials (CVE-2026-67620) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-67620 is a high-severity server-side request forgery (SSRF) in Flowise through 3.1.4 that lets authenticated attackers steal cloud instance identity credentials from Oracle Cloud Infrastructure and Alibaba Cloud metadata endpoints. No vendor patch is available yet; apply the mitigations below.

Overview

Flowise is a popular low-code platform for building LLM applications and visual chatflows. The vulnerability lives in the SSRF guard in httpSecurity.ts, specifically the DEFAULT_DENY_LIST that is supposed to block requests to internal or sensitive endpoints. That list omits two cloud metadata services: Oracle Cloud Infrastructure at 192.0.0.192 and Alibaba Cloud at 100.100.100.200.

An authenticated attacker can exploit this by calling the fetch-links API endpoint with a crafted URL parameter pointing at one of those metadata endpoints. The guard’s validation is weak enough to be bypassed with redirects, so the server follows the chain and issues the request itself. On Oracle or Alibaba Cloud deployments, that exposes instance identity documents and role-based credentials. In setups where URL-fetching nodes exist in public chatflows, the attack can be executed without any authentication.

The CVSS score is 7.7 (High), with a network attack vector, low complexity, and low privileges required. No user interaction is needed.

Impact

The core risk is credential theft from cloud metadata services. An attacker who successfully reaches these endpoints obtains temporary role credentials tied to the Flowise instance. Those credentials can then be used to pivot into other cloud resources, read object storage, access databases, or move laterally within the cloud account. On affected deployments, this effectively turns a low-privilege web request into broad cloud access.

The unauthenticated scenario is worse: if any public chatflow includes a URL-fetching node, the SSRF is reachable by anyone, with no account needed.

Remediation

There is no patched version of Flowise available as of this writing. Until a fix ships, take the following steps:

1. Block egress to metadata endpoints at the firewall or cloud security group level. Specifically deny outbound traffic to 192.0.0.192/32 and 100.100.100.200/32.
2. Restrict access to the fetch-links endpoint so that only trusted, authenticated users can reach it.
3. Disable or remove URL-fetching nodes from public chatflows to eliminate the unauthenticated attack path.
4. Rotate any cloud role credentials if you suspect the metadata service was already queried.

Security Insight

This vulnerability is a reminder that SSRF guardlists are only as good as their completeness. Cloud providers add new metadata endpoints over time, and a hardcoded deny list that misses one region or provider silently weakens the entire defense. The same pattern has bitten other platforms - compare this to the Oracle WebLogic CVE-2024-21182 issue, where a missing input check let attackers reach internal resources. For Flowise operators, the lesson is to treat the built-in SSRF guard as a best-effort baseline, not a security boundary, and enforce real network-layer restrictions on top.

Further Reading

• Oracle WebLogic CVE-2024-21182 exploited in the wild
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs