CVE-2026-43995 Details
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.
A vulnerability in Flowise prior to version 3.1.0 allows for Server-Side Request Forgery (SSRF) attacks by bypassing centralized HTTP security measures. Multiple tool implementations directly use raw HTTP clients, such as node-fetch and axios, without going through the secured wrapper that enforces deny-list validation and IP pinning. This oversight restores full SSRF capabilities, enabling access to internal network resources and cloud metadata, which could lead to credential theft.
Users are advised to update to Flowise version 3.1.0 or later, refactor tools to use the centralized secureFetch() wrapper, add ESLint rules to prevent direct imports of node-fetch or axios, and consider implementing a single internal HTTP client abstraction layer.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |