CVE-2026-41272: Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)

April 16, 2026 (updated April 24, 2026)

The core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding (Time-of-Check Time-of-Use) or by exploiting the default configuration which fails to enforce any deny list.

References

github.com/FlowiseAI/Flowise/security/advisories/GHSA-2x8m-83vc-6wv4
github.com/advisories/GHSA-2x8m-83vc-6wv4
nvd.nist.gov/vuln/detail/CVE-2026-41272

Code Behaviors & Features

Detect and mitigate CVE-2026-41272 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →