CVE-2026-127214

{
  "etk_id": "ETK-2026-4435",
  "cve_id": "CVE-2026-127214",
  "display_id": "CVE-2026-127214",
  "ghsa_id": "GHSA-vqvj-w792-h4m6",
  "euvd_id": "EUVD-2026-125728",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Server-side request forgery in Flowise Custom Function sandbox",
  "summary": "Flowise through version 3.1.4 is affected by a server-side request forgery weakness in its Custom Function sandbox. An authenticated user with chatflow or agentflow create or update permissions may cause the Flowise server to contact internal, loopback, or cloud metadata services.",
  "mitigation": "Restrict Custom Function use and remove chatflow or agentflow create/update permissions from untrusted accounts. Apply outbound network controls so the Flowise service cannot reach internal management endpoints, loopback services, or cloud metadata addresses.",
  "vendor": "FlowiseAI",
  "product": "Flowise",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.1.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Flowise",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 25.8011544,
  "t0_at": "2026-11-13T19:27:24.723000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-13T19:27:24.723000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T19:27:24.723000+00:00",
      "url": "https://github.com/advisories/GHSA-vqvj-w792-h4m6"
    }
  }
}