CVE-2026-41271 is a Server-Side Request Forgery (SSRF) vulnerability affecting FlowiseAI's Flowise product before version 3.1.0. The vulnerability exists in the POST/GET API Chain components, where unauthenticated attackers can inject malicious prompt templates to force the server to make arbitrary HTTP requests. This can lead to bypassing intended API constraints and redirecting requests to sensitive internal services, enabling potential internal network reconnaissance and data exfiltration. The vulnerability is rated with a CVSS 3.0 score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), indicating high impact on confidentiality and integrity with low privileges required but high attack complexity. The issue is fixed in Flowise version 3.1.0.

Successful exploitation allows unauthenticated attackers to coerce the vulnerable server to send arbitrary HTTP requests to internal or external systems. This can lead to unauthorized access to sensitive internal services, internal network reconnaissance, and potential data exfiltration. The vulnerability impacts confidentiality and integrity with limited impact on availability.

Upgrade Flowise to version 3.1.0 or later, where this SSRF vulnerability is fixed. Since the vendor advisory confirms the fix in 3.1.0, applying this official update is the recommended remediation. No additional mitigation guidance is provided or required beyond applying the official fix.