CVE-2026-91935 Overview
CVE-2026-91935 is a Server-Side Request Forgery (SSRF) vulnerability in Flowise versions prior to 3.1.4. The flaw exists in chat-model nodes that fail to validate the baseURL parameter before dispatching outbound requests. Authenticated users holding chatflows:create or chatflows:update permissions can redirect Large Language Model (LLM) provider requests to arbitrary hosts. This enables exfiltration of configured LLM provider API keys to attacker-controlled endpoints, cloud instance metadata services, or internal network resources. The vulnerability is classified as [CWE-918] Server-Side Request Forgery.
Critical Impact
Authenticated attackers can steal LLM provider API keys and pivot into internal cloud infrastructure by redirecting chat-model requests to attacker-controlled or metadata endpoints.
Affected Products
- Flowise versions prior to 3.1.4
- FlowiseAI chat-model node components
- Deployments exposing chatflow creation or update permissions to users
Discovery Timeline
- 2026-09-15 - CVE-2026-91935 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-91935
Vulnerability Analysis
Flowise is a low-code platform for building LLM applications through visual chatflow orchestration. Chat-model nodes accept a baseURL parameter that directs where the node dispatches API requests along with configured provider credentials. Prior to version 3.1.4, this parameter accepted arbitrary URLs without host allowlisting or scheme restrictions.
An authenticated user with chatflows:create or chatflows:update permissions can modify the baseURL to point at any reachable host. When the chatflow executes, the Flowise backend attaches the configured provider API key (for example, an OpenAI or Anthropic key) to the outbound request and sends it to the attacker-specified destination. The receiving host captures the credential in request headers or bodies.
Beyond credential theft, the same primitive allows requests to internal-only services and cloud metadata endpoints such as 169.254.169.254, enabling reconnaissance and potential retrieval of temporary cloud credentials.
Root Cause
The root cause is missing input validation on the baseURL field in chat-model node handlers. The application trusts user-supplied URL values and forwards sensitive credentials without verifying that the destination matches an expected provider endpoint.
Attack Vector
Exploitation requires network access to the Flowise interface and an authenticated account with chatflow modification rights. The attacker configures a chat-model node with baseURL set to a controlled listener or an internal address, saves the chatflow, and triggers execution. Refer to the VulnCheck SSRF Advisory and the GitHub Security Advisory for technical specifics.
Detection Methods for CVE-2026-91935
Indicators of Compromise
- Outbound HTTP or HTTPS connections from Flowise hosts to destinations that are not recognized LLM providers.
- Requests originating from the Flowise process to link-local metadata addresses such as 169.254.169.254 or internal RFC1918 ranges.
- Chatflow definitions containing baseURL values that do not match approved provider domains.
- Unexpected authentication failures or rate-limit events from LLM providers indicating key reuse from unfamiliar IPs.
Detection Strategies
- Inspect stored chatflow JSON for chat-model nodes whose baseURL deviates from known provider endpoints such as api.openai.com or api.anthropic.com.
- Enable and review Flowise audit logs for chatflows:create and chatflows:update events, correlating with the user account and resulting node configuration.
- Deploy egress network monitoring on Flowise infrastructure to alert on connections to non-allowlisted destinations.
Monitoring Recommendations
- Alert on any request from Flowise workloads to cloud metadata endpoints or private IP ranges.
- Track LLM provider API key usage from unexpected source IPs and rotate keys on anomaly.
- Monitor role assignments granting chatflows:create or chatflows:update permissions and review non-administrator accounts holding these rights.
How to Mitigate CVE-2026-91935
Immediate Actions Required
- Upgrade all Flowise instances to version 3.1.4 or later.
- Rotate every LLM provider API key configured in Flowise, assuming prior exposure if user-writable chatflows existed.
- Audit current chatflow definitions for suspicious baseURL values and remove any pointing outside approved providers.
- Restrict chatflows:create and chatflows:update permissions to trusted administrators only.
Patch Information
Flowise version 3.1.4 introduces validation of the baseURL parameter in chat-model nodes. Details are published in the GitHub Security Advisory GHSA-hx55-h48h-7rw9.
Workarounds
- Place Flowise behind an egress proxy that allowlists only known LLM provider domains.
- Block outbound access from Flowise hosts to link-local addresses including 169.254.169.254 and to internal management networks.
- Revoke chatflow modification permissions from non-administrative users until the patch is applied.
- Deploy Flowise in network segments that cannot reach cloud metadata services or sensitive internal APIs.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
