CVE-2026-91938

Flowise versions before 3.1.4 contain a server-side request forgery (CWE-918) flaw in the Cheerio, Playwright, and Puppeteer document loader nodes that bypasses the application's built-in SSRF protections. An attacker who can influence a document loader node (e.g., a workflow user or anyone with access to an exposed instance) can supply an arbitrary URL causing the server to fetch cloud metadata services, internal APIs, and other private network resources. Because the fetched response is returned as document text, the attacker can read the content directly, enabling theft of cloud credentials, API keys, and internal service data. Anyone self-hosting Flowise prior to version 3.1.4 with these document loader nodes available is affected, especially internet-facing deployments. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and no exploitation in the wild has been reported.

What to do: Upgrade Flowise to version 3.1.4 or later as soon as possible. If upgrading is delayed, restrict egress from Flowise hosts so they cannot reach cloud metadata endpoints (e.g., 169.254.169.254, metadata.google.internal) or internal/private address ranges, and limit who can create or edit flows on the instance. Review historical logs for document loader nodes fetching internal IPs or metadata URLs, and rotate any cloud or API credentials if such activity is found.