The vulnerability identified as CVE-2026-56275 affects Flowise prior to version 3.1.0. It is a server-side request forgery (CWE-918) issue in the Execute Flow node, where attackers can bypass security checks by providing intranet addresses in the base URL field. This enables them to initiate HTTP requests to internal network addresses, access cloud metadata services, and enumerate internal services. The root cause is the absence of secureFetch verification in the httpSecurity.ts file, which fails to properly validate or restrict outbound requests initiated by the application.

Exploitation of this vulnerability could allow an attacker with limited privileges to make unauthorized HTTP requests from the server to internal network addresses. This can lead to information disclosure such as cloud metadata access and internal service enumeration. There is no indication of direct remote code execution or privilege escalation from the provided data. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the affected functionality and consider network-level controls to limit server outbound requests to trusted destinations.