CVE-2026-90580

Name of the Vulnerable Software and Affected Versions FlowiseAI Flowise versions prior to 3.1.3

Description A server-side request forgery (SSRF) exists in the Evaluations Endpoint component within the axios.post() function of the packages/server/src/controllers/evaluations/index.ts file. This issue allows a remote attacker to trigger unauthorized requests by manipulating the Host or X-Forwarded-Proto variables. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Upgrade to version 3.1.3.