CVE-2026-69250 FlowiseAI CVE debrief

Who should care

Flowise users and administrators should verify their instance exposure and update to the patched version. Security teams should monitor for suspicious outbound requests and token refresh activity. Operators and platform administrators should review and restrict access to the OAuth2 token refresh endpoint. Vulnerability management and security teams should prioritize this issue due to its high severity and potential impact.

Why it matters

CVE-2026-69250 is a high-severity unauthenticated SSRF vulnerability in Flowise's OAuth2 token refresh endpoint. Defenders should verify Flowise instance exposure, restrict access to the endpoint, and monitor for suspicious activity. The issue is fixed in version 3.1.3.

• Verify Flowise instance exposure and update priority
• Restrict access to the OAuth2 token refresh endpoint
• Monitor for suspicious outbound requests and token refresh activity

Technical summary

CVE-2026-69250 is an unauthenticated SSRF vulnerability in Flowise's OAuth2 token refresh endpoint. The endpoint performs a server-side HTTP request to the credential-controlled accessTokenUrl without SSRF protections, allowing an attacker to trigger outbound POST requests to a controlled server. The issue is fixed in version 3.1.3 and has a high CVSS score of 8.5. Defenders should verify Flowise instance exposure, restrict access to the endpoint, and monitor for suspicious activity. The vulnerability allows an attacker to send client_id, client_secret, grant_type=refresh_token, and refresh_token in the request body.

Defensive priority

High priority for Flowise users and administrators to verify and update

Recommended defensive actions

• Verify Flowise instance exposure and update to version 3.1.3 or later
• Review and restrict access to the OAuth2 token refresh endpoint
• Monitor for suspicious outbound requests and token refresh activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry confirm an unauthenticated SSRF vulnerability in Flowise's OAuth2 token refresh endpoint. Vendor patches are available in version 3.1.3. The issue allows an attacker to trigger outbound POST requests to a controlled server without authentication. The endpoint is reachable without authentication and reflects the full remote response body to the caller through tokenInfo.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.