Executive Threat Advisory: AI Pipeline Exposure & Metadata Theft

A high-severity Server-Side Request Forgery (SSRF) vulnerability has been disclosed in Flowise, a widely adopted open-source low-code platform used by enterprise engineering teams to build and orchestrate customized Large Language Model (LLM) agent pipelines, LangChain flows, and retrieval-augmented generation (RAG) applications.

Cataloged as CVE-2026-67620 with a CVSS v3.1 base score of 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), the vulnerability resides within the application's internal URL validation and HTTP security filtering component. By exploiting an incomplete IP address blacklist, an authenticated user—or an external threat actor exploiting unauthenticated deployments—can compel the Flowise backend server to issue arbitrary HTTP requests to link-local cloud metadata services, exfiltrating temporary cloud instance credentials and pivot tokens.

Vulnerability Mechanics & Root Cause: Incomplete Deny-Lists (CWE-918)

Flowise allows users to configure document loaders, web scrapers, and API nodes that fetch remote resources over HTTP to ingest contextual data into vector stores. To prevent users from using these nodes to probe internal corporate networks or cloud infrastructure, Flowise implements an SSRF guard inside packages/server/src/utils/httpSecurity.ts.

This guard checks incoming target URLs against a regular-expression-based DEFAULT_DENY_LIST containing known private network ranges (such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and standard AWS/GCP link-local metadata addresses (169.254.169.254).

However, the implementation suffered from critical omissions:

  1. Omitted Cloud Metadata IP Ranges: The deny-list omitted the non-standard metadata IP addresses utilized by other major enterprise cloud providers, specifically:
    • Oracle Cloud Infrastructure (OCI): http://192.0.0.192/latest/
    • Alibaba Cloud: http://100.100.100.200/latest/meta-data/
  2. Redirection & DNS Rebinding Bypass: The /api/v1/fetch-links endpoint failed to re-validate destination IP addresses following HTTP 301/302 redirects, allowing an attacker to supply a public domain that immediately redirects to internal link-local endpoints.
  3. Payload Execution: When Flowise executes the request, it transmits an HTTP GET request to the instance metadata service from within the cloud VM's trusted security context, returning sensitive JSON payloads containing temporary API signing keys, instance private keys, and cloud compartment identifiers directly to the attacker's browser interface.

Blast Radius: From AI Canvas to Multi-Cloud Account Compromise

In enterprise environments, Flowise instances are frequently hosted inside cloud virtual machines (such as OCI Compute instances or Alibaba ECS nodes) that possess attached instance profiles or managed identity roles to communicate with cloud vector databases and LLM APIs.

Cloud Provider Exposed Metadata Endpoint Exfiltrated Asset Operational Impact
Oracle Cloud (OCI) http://192.0.0.192/opc/v2/instance/ Instance Principal cryptographic key pairs and session security tokens. Allows attacker to forge authenticated OCI CLI calls, dump Oracle Autonomous Databases, and terminate cloud workloads.
Alibaba Cloud http://100.100.100.200/latest/meta-data/ram/security-credentials/ Resource Access Management (RAM) role temporary credentials. Enables full privilege escalation across Object Storage Service (OSS) buckets and VPC networks.

Remediation Playbook & Cloud Workload Hardening

Organizations utilizing Flowise must immediately enact the following defensive measures:

1. Upgrade Flowise Platform

Update Flowise to version 3.1.5 or higher, which enforces comprehensive CIDR-based metadata blocking and redirect re-evaluation: 

# Update npm package globally
npm update -g flowise

# Docker deployment update
docker pull flowiseai/flowise:latest
docker-compose down && docker-compose up -d

2. Enforce Mandatory Flowise Authentication

Never expose Flowise to public ingress without strict authentication. Verify that FLOWISE_USERNAME and FLOWISE_PASSWORD are declared in environment files: 

FLOWISE_USERNAME=admin_secops
FLOWISE_PASSWORD=Str0ng_P@ssw0rd_2026!
PORT=3000

3. Enforce Host-Level IMDS Egress Firewalls

Apply local firewall rules on the host container or VM to drop outbound traffic to non-routable link-local metadata addresses from the application user: 

# Linux iptables: Block application UID from reaching OCI metadata service
iptables -A OUTPUT -m owner --uid-owner node -d 192.0.0.192 -j DROP
iptables -A OUTPUT -m owner --uid-owner node -d 100.100.100.200 -j DROP
iptables -A OUTPUT -m owner --uid-owner node -d 169.254.169.254 -j DROP