What is GHSA-w4hm-rrxg-pxcf?

GHSA-w4hm-rrxg-pxcf is a security advisory published by GitHub Security Advisories with Medium severity. Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow...

Which CVE IDs does GHSA-w4hm-rrxg-pxcf cover?

GHSA-w4hm-rrxg-pxcf covers the following CVE IDs: CVE-2026-56275. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w4hm-rrxg-pxcf?

GHSA-w4hm-rrxg-pxcf has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

GHSA-w4hm-rrxg-pxcfMediumCVSS 7.1

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow...

Vendor

GitHub Security Advisories

Published

June 23, 2026

Last Modified

June 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-56275 →

📋 Description

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud metadata, and enumerate internal services by exploiting the missing secureFetch verification in httpSecurity.ts.

🔗 References (4)

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9hrv-gvrv-6gf2
https://nvd.nist.gov/vuln/detail/CVE-2026-56275
https://www.vulncheck.com/advisories/flowise-server-side-request-forgery-via-execute-flow-base-url
https://github.com/advisories/GHSA-w4hm-rrxg-pxcf