CVE-2026-90580

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90580
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90580.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90580
Published
2026-09-13T19:15:09Z
Modified
2026-09-16T03:30:57Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
Details

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.1.3 is able to resolve this issue. The patch is identified as 700137738bcaebefd4709021f6d6b0abcd7df0ac. It is recommended to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90580.json"
}
References

Affected packages

Git / github.com/flowiseai/flowise

Affected ranges

Type
GIT
Repo
https://github.com/flowiseai/flowise
Events
Introduced
a6e64230b4205e0f767e150e44f6e9ba59143de8
Fixed
700137738bcaebefd4709021f6d6b0abcd7df0ac
Fixed
09f099dbfda179e439ec677d06ad737375899eef
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.0"
        },
        {
            "introduced": "3.0.1"
        },
        {
            "last_affected": "3.0.1"
        },
        {
            "introduced": "3.0.2"
        },
        {
            "last_affected": "3.0.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.0.0
3.0.1
3.0.2
flowise-components@3.*
flowise-components@3.0.0
flowise-components@3.0.1
flowise-components@3.0.10
flowise-components@3.0.11
flowise-components@3.0.12
flowise-components@3.0.13
flowise-components@3.0.2
flowise-components@3.0.3
flowise-components@3.0.4
flowise-components@3.0.5
flowise-components@3.0.6
flowise-components@3.0.7
flowise-components@3.0.8
flowise-components@3.0.9
flowise-components@3.1.0
flowise-components@3.1.1
flowise-components@3.1.2
flowise-ui@3.*
flowise-ui@3.0.0
flowise-ui@3.0.1
flowise-ui@3.0.10
flowise-ui@3.0.11
flowise-ui@3.0.12
flowise-ui@3.0.13
flowise-ui@3.0.2
flowise-ui@3.0.3
flowise-ui@3.0.4
flowise-ui@3.0.5
flowise-ui@3.0.6
flowise-ui@3.0.7
flowise-ui@3.0.8
flowise-ui@3.0.9
flowise-ui@3.1.0
flowise-ui@3.1.1
flowise-ui@3.1.2
flowise@3.*
flowise@3.0.0
flowise@3.0.1
flowise@3.0.10
flowise@3.0.11
flowise@3.0.12
flowise@3.0.13
flowise@3.0.2
flowise@3.0.3
flowise@3.0.4
flowise@3.0.5
flowise@3.0.6
flowise@3.0.7
flowise@3.0.8
flowise@3.0.9
flowise@3.1.0
flowise@3.1.1
flowise@3.1.2
Other
pre-langchain-v1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90580.json"