CVE-2026-90580

Executive Summary

CVE-2026-90580 is a server-side request forgery (SSRF) vulnerability in FlowiseAI Flowise, an open-source low-code platform for building LLM orchestration and AI agent workflows. The flaw affects the Evaluations Endpoint component (packages/server/src/controllers/evaluations/index.ts), where manipulation of the Host / X-Forwarded-Proto arguments passed to an axios.post call allows an attacker to redirect server-originated requests to arbitrary destinations. The vulnerability is remotely exploitable with low privileges (CVSS 6.3), an exploit has been made public, and upgrading to version 3.1.3 resolves the issue.

Technical Analysis

CVE-2026-90580 is classified as CWE-918 (Server-Side Request Forgery). The vulnerable code path resides in the Evaluations Endpoint controller at packages/server/src/controllers/evaluations/index.ts, which uses the axios.post function to issue an outbound HTTP request. Per the NVD description, the specific root cause is the manipulation of the argument Host/X-Forwarded-Proto — that is, the destination URL for the outbound request is derived, directly or indirectly, from attacker-controllable request metadata rather than from a fixed, server-side trusted base URL.

The attack surface is the Evaluations Endpoint, which exposes evaluation functionality of the Flowise server to authenticated (or low-privilege) callers. Because the endpoint constructs its outbound axios.post target from the incoming Host header and/or the X-Forwarded-Proto header, an attacker can influence where the server sends its request. X-Forwarded-Proto is a standard proxy header indicating the original protocol (http/https); Host indicates the requested hostname. When an application trusts these client-supplied headers without validation and uses them to build an internal or downstream request URL, an attacker can substitute an arbitrary host/protocol and cause the Flowise server to issue requests to destinations of the attacker's choosing.

This is a classic trust-boundary failure: proxy/forwarding headers are trivially spoofable by any client that can reach the endpoint directly, yet the application treats them as authoritative when composing an outbound request. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L confirms: network-reachable, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact across confidentiality, integrity, and availability.

Patch confidence is 0/4 (UNPATCHED) across all tracked sources. Although the NVD record references an upgrade to 3.1.3 and a patch commit hash (700137738bcaebefd4709021f6d6b0abcd7df0ac), no patch evidence could be corroborated from tracked sources, and the component is reported to only affect products the maintainer no longer supports. Operators should treat deployed instances as unpatched and apply compensating controls. Note: no EPSS score has been assigned by FIRST.org, and no public Nuclei template, exploit code, or CISA KEV listing is present in the provided data, despite the NVD description stating the exploit "has been made public."

Exploitation Scenarios

No public PoC (template/exploit code) is available in the supplied intelligence; the attack chain below is inferred from the vulnerability class (SSRF via header-controlled request URL) and the exact parameters named in the NVD description.

1. Reconnaissance / target identification. An attacker identifies a reachable Flowise instance (e.g., via Shodan using the product/title dorks above) running version <= 3.0.2. The attacker confirms which endpoints are accessible and obtains any required low-privilege access or API credentials (PR:L indicates low privileges suffice — no admin needed).

2. Triggering the flaw. The attacker sends a request to the Evaluations Endpoint while setting the Host header and/or X-Forwarded-Proto header to values controlled by the attacker. Because the Evaluations controller builds its outbound axios.post destination from these headers, the server's request is directed to the attacker-specified host and/or protocol instead of the intended internal service.

3. Payload / execution method. At the vulnerability-class level, the payload is a crafted HTTP request whose Host/X-Forwarded-Proto values redirect the server-side axios.post to an arbitrary destination (attacker-controlled or internal). No specific request body, parameter names, or path beyond those in the description should be assumed, as the description does not disclose them.

4. Post-exploitation impact. With server-side request forgery, the attacker can (a) make the Flowise server issue requests to internal/cloud metadata services and other non-public endpoints reachable from the server, enabling enumeration of internal assets and potential credential/metadata theft; (b) direct the outbound call to attacker-controlled infrastructure for exfiltration or to observe/relay data; and (c) potentially induce state changes on internal services reachable only from the Flowise host (impacting integrity). Impact scores (C:L/I:L/A:L) indicate constrained but non-trivial effects, consistent with an SSRF reachable by low-privileged users on a network-exposed service.

Impact Assessment

• Confidentiality (Low): The SSRF can expose information about internal-only services or responses returned from the server's request, and may enable access to internal endpoints not otherwise reachable.
• Integrity (Low): Depending on what internal service the forged request hits (e.g., state-changing internal APIs), limited unauthorized modifications may be possible.
• Availability (Low): The attacker may trigger resource consumption or unwanted requests that degrade the downstream service.
• Blast radius: Limited to the Flowise server's network position. The primary risk is the server acting as a proxy/confused deputy into internal networks, cloud instance metadata, or adjacent services — a common prelude to lateral movement or credential access.
• Scope (Unchanged): The vulnerable component and the impacted component are the same (the Flowise server).
• Business impact: Organizations running Flowise 3.0.2 or earlier as an internet- or partner-facing AI orchestration service are exposed. Low privileges required and no user interaction make exploitation straightforward for anyone with endpoint access.

Detection Guidance

The SSRF is driven by Host and X-Forwarded-Proto header manipulation on the Evaluations Endpoint. Detection should focus on anomalous/duplicate/mismatched forwarding headers and outbound requests to unexpected destinations.

Sigma Rule

title: Flowise SSRF via Host/X-Forwarded-Proto Header Manipulation (CVE-2026-90580)
id: 9f3c2a54-7b1e-4d6a-9c88-flowise90580
status: experimental
description: Detects manipulation of Host/X-Forwarded-Proto on Flowise Evaluations Endpoint aligning with CVE-2026-90580 SSRF.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90580
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains: '/evaluations'
  selection_proto:
    cs-header|contains: 'X-Forwarded-Proto'
  selection_proto_value:
    cs-header|contains:
      - 'X-Forwarded-Proto: http'
      - 'X-Forwarded-Proto: https,'
      - 'X-Forwarded-Proto: gopher'
      - 'X-Forwarded-Proto: file'
      - 'X-Forwarded-Proto: dict'
  selection_host:
    cs-header|contains: 'Host: '
  suspicious_host:
    cs-header|contains:
      - 'Host: 127.0.0.1'
      - 'Host: localhost'
      - 'Host: 169.254.169.254'
      - 'Host: 10.'
      - 'Host: 192.168.'
      - 'Host: 172.16.'
  condition: selection_path and (selection_proto and selection_proto_value) or (selection_path and selection_host and suspicious_host)
level: high
tags:
  - attack.t1190
  - cve.2026.90580

(Note: field names vary by log source; adjust cs-header/cs-uri-stem to your web server schema.)

YARA Rule

rule CVE_2026_90580_Flowise_SSRF_Evaluations
{
    meta:
        description = "Detects Flowise Evaluations controller SSRF indicators (Host/X-Forwarded-Proto trust) for CVE-2026-90580"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90580"
        date = "2026-01-01"
        severity = "high"

    strings:
        $path = "packages/server/src/controllers/evaluations/index.ts" ascii
        $axios = "axios.post" ascii
        $xfp = "X-Forwarded-Proto" ascii
        $host = "host" ascii nocase
        $eval = "/evaluations" ascii

    condition:
        uint16(0) == 0x0A3D or
        ( $axios and $xfp and $host ) or
        ( $path and $eval )
}

(The uint16(0) == 0x0A3D branch is a placeholder — replace with a meaningful file-type magic if scanning binaries; the string-based conditions are intended for source/log scanning.)

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90580 Flowise SSRF via X-Forwarded-Proto manipulation"; flow:established,to_server; http.header; content:"X-Forwarded-Proto"; nocase; http.header; content:"gopher"; nocase; http.uri; content:"/evaluations"; nocase; reference:cve,2026-90580; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90580; classtype:web-application-attack; sid:9026080; rev:1;)

A second rule for internal-target Host spoofing:

alert http any any -> any any (msg:"CVE-2026-90580 Flowise SSRF internal Host header on Evaluations endpoint"; flow:established,to_server; http.uri; content:"/evaluations"; nocase; http.header; content:"Host|3a| 169.254.169.254"; nocase; reference:cve,2026-90580; classtype:web-application-attack; sid:9026081; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method == "POST" and url.path : "/evaluations" and
      http.request.headers : ("X-Forwarded-Proto" and ("gopher" or "file" or "dict" or "http://127.0.0.1" or "http://169.254.169.254")) ]
  [ network where http.request.method in ("POST","PUT","GET") and destination.ip not in ("10.0.0.0/8","192.168.0.0/16","172.16.0.0/12") and
      http.request.headers : "X-Forwarded-Proto" ]

(EQL syntax varies by ECS field availability; treat as a detection template keyed on the Evaluations path plus forwarding-header anomalies.)

Splunk SPL Query

index=web OR index=proxy
(method="POST" path="*/evaluations*")
| eval xfp=coalesce(X_Forwarded_Proto, x_forwarded_proto)
| eval host=coalesce(Host, host_header)
| where (isnotnull(xfp) AND (match(lower(xfp),"^(gopher|file|dict)") OR match(xfp,"127\.0\.0\.1|169\.254\.169\.254")))
        OR (isnotnull(host) AND match(host,"127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|192\.168\.|172\.16\."))
| stats count min(_time) as first_seen max(_time) as last_seen values(host) as hosts values(xfp) as protos by src_ip, uri_path
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="flowise,cve-2026-90580,ssrf,">
  <rule id="905800" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\/evaluations</field>
    <field name="http_headers.X-Forwarded-Proto">gopher|file|dict|127\.0\.0\.1|169\.254\.169\.254</field>
    <description>CVE-2026-90580: Flowise SSRF attempt via X-Forwarded-Proto on Evaluations endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="905801" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\/evaluations</field>
    <field name="http_headers.Host">127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|192\.168\.|172\.16\.</field>
    <description>CVE-2026-90580: Flowise SSRF internal Host header on Evaluations endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

(Rule IDs/field names are illustrative; align with your Wazuh decoder and log schema.)

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (compensating controls):

   • Restrict network access to the Flowise server and specifically the Evaluations Endpoint — place it behind an authenticated reverse proxy and do not expose it to untrusted networks.
   • Configure the reverse proxy to overwrite (not append) Host and X-Forwarded-Proto with trusted values, and strip client-supplied forwarding headers before they reach Flowise.
   • Apply egress network filtering (deny-by-default) so the Flowise server cannot reach internal metadata services (e.g., link-local 169.254.0.0/16) or unintended internal ranges; enforce IMDSv2/instance-metadata protections.
   • Enforce least privilege on who can reach the Evaluations functionality; rotate any API keys exposed to low-privilege users.

2. Patch / upgrade steps:

   • Upgrade Flowise to 3.1.3, which the NVD record states resolves the issue. The referenced fix commit is 700137738bcaebefd4709021f6d6b0abcd7df0ac.
   • Because patch confidence is 0/4, verify the fix independently against upstream release notes before relying on it; test in a staging environment.
   • Note the NVD statement that this vulnerability "only affects products that are no longer supported by the maintainer" — if your deployment cannot be upgraded to 3.1.3, treat it as end-of-life and migrate.

3. Long-term hardening:

   • Never construct outbound request URLs from client-controlled headers; use server-side allow-lists of permitted destinations and protocols (http/https only).
   • Validate/whitelist Host and X-Forwarded-* at the edge and code level.
   • Adopt outbound egress allow-listing and SSRF-safe HTTP clients for all server-originated requests.
   • Monitor the Evaluations Endpoint and forwarding-header anomalies continuously (see Detection Guidance).

References

• NVD — CVE-2026-90580: https://nvd.nist.gov/vuln/detail/CVE-2026-90580
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• FlowiseAI project repository / releases (verify 3.1.3 fix; commit 700137738bcaebefd4709021f6d6b0abcd7df0ac): https://github.com/FlowiseAI/Flowise
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS: Not yet scored — no EPSS value available for this CVE (do not treat as zero risk).

Threat actor / exploit-in-the-wild evidence: The NVD description states the exploit "has been made public." No specific threat actor campaign, CISA KEV listing, Nuclei template, or public exploit-code artifact was present in the provided intelligence at time of writing.