CVE-2026-9813 is a server side request forgery in FlowIntel up to version 3.3.0, rated 9.9. The external reference URL probe in app/case/task.py sends a request to a user chosen address without enough checks. Update to a build that includes the project's fix commit.
What's affected
- Product: FlowIntel, the open source case management tool.
- Affected: versions up to 3.3.0, per the record.
- Fixed version: the record gives no release number. The fix is a commit in the flowintel repository, so check that your build contains it.
- Entry point: the code that probes an external reference URL, which issues an HTTP HEAD request to the address supplied.
- Attacker needs: a way to submit an external reference URL, which the vector says needs low privileges.
How to check if you're exposed
If you run FlowIntel from a git checkout, test whether the fix commit is part of your history:
git merge-base --is-ancestor 68b523b47854c54bf36fd706c0fd5353063b5409 HEAD && echo patched || echo not patched
If you run a packaged or container build, compare it with a project release that includes the commit, and ask the maintainers if the release notes are unclear. Also check which networks the FlowIntel server can reach, since that decides what the flaw could touch.
What to do now
- Update FlowIntel to a build that contains commit 68b523b, or pull the latest from the project.
- Restrict outbound traffic from the FlowIntel host so it cannot reach internal services, loopback or cloud metadata addresses it does not need.
- Where your cloud supports it, require the stronger session based metadata access mode so a simple request cannot read credentials.
- Review who has accounts that can add external references, and remove accounts you do not need.
- Check server logs for HEAD requests to internal or unusual addresses from the application.
Why it matters
The record lists CWE-918, server side request forgery. The application makes a request on behalf of a user, so the request comes from the server's own position in the network. That position often reaches things the user cannot, such as internal services or cloud metadata endpoints. The record says validation of the URL scheme and of the resolved destination address was insufficient.
The fix commit adds checks. It limits the scheme to http and https, requires a hostname, resolves the host and rejects addresses that are private, loopback, link local, multicast, reserved or unspecified. The vector shows a changed scope, which is why the score reaches 9.9. The record does not mark the CVE as exploited in the wild.
Quick check
Is a HEAD request really dangerous?
It can reveal which internal services exist and sometimes triggers actions on services that do not check the method. Combined with a changed scope, the record rates the impact as high.
Sources
Last reviewed: 19 October 2026.
