CVE-2026-91935

Flowise before version 3.1.4 contains a server-side request forgery (SSRF) flaw (CWE-918) because the baseURL parameter in chat-model nodes is not validated. An authenticated user with chatflows:create or chatflows:update permissions can set a chat-model node's baseURL to an attacker-controlled host, causing the Flowise server to send its requests — including the configured LLM provider API key — to that destination. By pointing the baseURL at cloud metadata services (e.g., 169.254.169.254) or internal hosts, an attacker can exfiltrate credentials and probe the internal network. Self-hosted Flowise deployments running versions before 3.1.4 are affected, with the highest risk in multi-user instances where lower-privileged users can edit chatflows. The flaw is scored CVSS 4.0 8.7 (high); it is not in the CISA KEV catalog, no public PoC is known, and no exploitation has been observed.

What to do: Upgrade Flowise to version 3.1.4 or later, which validates baseURL parameters in chat-model nodes. Restrict chatflows:create and chatflows:update permissions to trusted users only, and audit existing chatflows for suspicious or unexpected baseURL values pointing to external domains or metadata endpoints. Additionally, block egress from Flowise servers to cloud metadata IPs (e.g., 169.254.169.254 and metadata.google.internal) at the network layer, and rotate LLM provider API keys if any untrusted users had chatflow editing access.