CVE-2026-41271CWE-918

Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

High · published April 23, 2026

CVSS v3.0
7.1
EPSS
0%
Percentile
26.4
In the wild
Unconfirmed
What it is

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems. By injecting malicious prompt templates, attackers can bypass the intended API documentation constraints and redirect requests to sensitive internal services, potentially leading to internal network reconnaissance and data exfiltration. This vulnerability is fixed in 3.1.0.

The record
Technical detail
CVSS v3.0
7.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00342 · 26.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-04-23T19:17Z
EPSS history
Timeline
  • 23 APR 19:17Z
    Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
    cvelistv5