How severe is CVE-2026-9813?

CVE-2026-9813 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-9813 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-9813?

CVE-2026-9813 affects Flowintel. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-9813?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-9813 have an EU (EUVD) identifier?

Yes. CVE-2026-9813 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-32862.

When was CVE-2026-9813 published?

CVE-2026-9813 was published on 2026-05-28 and last updated on 2026-06-17.

CVE-2026-9813

CVE-2026-9813 is a critical-severity vulnerability in Flowintel with a CVSS 3.x base score of 9.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-918.

Key facts

Severity: Critical (CVSS 3.x base score 9.9)
CVSS v4: 6.2
EPSS exploit prediction: 0% (14th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-32862
Weakness: CWE-918
Affected product: Flowintel
Published: 2026-05-28
Last modified: 2026-06-17

Description

FlowIntel up to version 3.3.0 contains a server-side request forgery (SSRF) vulnerability in the external reference URL probe functionality in app/case/task.py. An attacker who can submit an external reference URL can cause the application server to issue an HTTP HEAD request to an attacker-specified destination. Due to insufficient validation of the URL scheme and resolved destination address, affected versions may allow requests to loopback, link-local, private, reserved, or other restricted network resources, potentially enabling interaction with internal services or cloud metadata endpoints from the server's network context.

Frequently asked questions

What is CVE-2026-9813?: FlowIntel up to version 3.3.0 contains a server-side request forgery (SSRF) vulnerability in the external reference URL probe functionality in app/case/task.py. An attacker who can submit an external reference URL can cause the application server to issue an HTTP HEAD request to an attacker-specified destination. Due to insufficient validation of the URL scheme and resolved destination address, affected versions may allow requests to loopback, link-local, private, reserved, or other restricted network resources, potentially enabling interaction with internal services or cloud metadata endpoints from the server's network context.
How severe is CVE-2026-9813?: CVE-2026-9813 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-9813 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-9813?: CVE-2026-9813 affects Flowintel. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-9813?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-9813 have an EU (EUVD) identifier?: Yes. CVE-2026-9813 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-32862.
When was CVE-2026-9813 published?: CVE-2026-9813 was published on 2026-05-28 and last updated on 2026-06-17.

References

https://github.com/flowintel/flowintel/commit/68b523b47854c54bf36fd706c0fd5353063b5409

Affected products (1)

cpe:2.3:a:flowintel:flowintel:*:*:*:*:*:*:*:*

Other CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities

CVE-2026-47938 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF)…
CVE-2026-35431 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to…
CVE-2026-32186 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a…
CVE-2026-33107 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a…
CVE-2026-32871 — Critical (CVSS 10.0): FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP…
CVE-2026-32169 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a…

Browse all CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities →