CVE-2026-41272 is a Server-Side Request Forgery (SSRF) vulnerability in FlowiseAI Flowise before version 3.1.0. The issue arises from multiple logic flaws in the secureAxiosRequest and secureFetch security wrappers, which were intended to prevent SSRF attacks. These flaws enable attackers to bypass allow/deny lists via DNS Rebinding (a Time-of-Check Time-of-Use issue) or by exploiting default configurations that fail to enforce any deny list. The vulnerability is addressed in Flowise version 3.1.0. The product is a cloud-hosted service, and the vendor typically manages patching for such services.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized server-side requests, potentially leading to high confidentiality and integrity impacts and a low availability impact, as reflected by the CVSS vector. This could expose internal resources or sensitive data accessible from the server hosting Flowise. No known exploits are reported in the wild at this time.

A fix for this vulnerability is available in Flowise version 3.1.0. Since Flowise is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their service instance is updated to version 3.1.0 or later to ensure the vulnerability is mitigated.