CVE Intelligence
Analysis AI-assisted

CVE-2026-9813: FlowIntel SSRF via external reference URL probe

CVE-2026-9813 is a server-side request forgery in the external reference URL probe of FlowIntel, located in app/case/task.py. The record indicates that a user able to submit an external reference URL can make the server send an HTTP HEAD request to an attacker-chosen destination, including restricted network resources. NVD rates it critical (9.9), and the record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

FlowIntel has a server-side request forgery issue (CWE-918) in the external reference URL probe implemented in app/case/task.py. According to the record, a user who can submit an external reference URL can cause the application server to send an HTTP HEAD request to a destination of that user's choice.

Impact

  • The record states that affected versions may allow requests to loopback, link-local, private, reserved or other restricted network resources.
  • Successful exploitation could allow interaction with internal services or cloud metadata endpoints from the server's network context.
  • NVD assigns a CVSS base score of 9.9 (critical), with high confidentiality, integrity and availability impact and a changed scope in the vector.
  • SSVC rates technical impact as partial.

Affected products and versions

  • Product listed: Flowintel Flowintel.
  • The record lists the affected range as before 3.3.0.
  • The description says FlowIntel up to version 3.3.0 is affected. This differs slightly from the range listed above and should be confirmed with the vendor.
  • The only version boundary present in the record is 3.3.0.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.
  • EPSS probability is 0.00417 with a percentile of 0.34978, dated 2026-10-23 in the record.
  • SSVC lists exploitation as none and automatable as no.

Remediation and mitigation

  • Apply the patch referenced in the record, which is a commit in the FlowIntel GitHub repository.
  • Upgrade to 3.3.0 or later, since the record's affected range points to that version as the boundary. Confirm the exact fixed release with the maintainer.
  • Until the fix is deployed, limit which users can submit external reference URLs and restrict outbound connections from the application server through network egress controls.
  • Review whether internal services or cloud metadata endpoints are reachable from the FlowIntel host and reduce that exposure where possible.

Detection guidance

  • Monitor for unexpected outbound HTTP HEAD requests from the FlowIntel server to internal address ranges, loopback or link-local addresses.
  • Review application logs for external reference submissions that use unusual URL schemes or internal hostnames.
  • Alert on server-initiated connections from the application host to private or metadata networks that the application does not normally use.

Limitations of the available information

  • The record does not include the vendor's own advisory text, proof-of-concept details or test results.
  • The discrepancy between the affected range before 3.3.0 and the description's up to 3.3.0 is not resolved by the record.
  • The record does not state which specific deployments or configurations are exposed.
  • Exploitation likelihood is based only on the listed EPSS and SSVC data, which are not a confirmation of exploitation.

Frequently asked questions

What is CVE-2026-9813?

It is a server-side request forgery vulnerability in the external reference URL probe of FlowIntel, classified as CWE-918. The record says a user who can submit an external reference URL may cause the server to send HTTP HEAD requests to a chosen destination.

Is CVE-2026-9813 known to be exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The EPSS and SSVC data in the record are estimates, not confirmation of exploitation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.