CVE-2026-91938: Flowise Document Loader SSRF Vulnerability

CVE-2026-91938 Overview

CVE-2026-91938 is a server-side request forgery (SSRF) vulnerability affecting Flowise versions before 3.1.4. The flaw resides in the Cheerio, Playwright, and Puppeteer document loader nodes, which bypass the application's SSRF protection. Authenticated attackers can supply arbitrary URLs that Flowise fetches server-side, returning the response content as document text. This behavior enables retrieval of cloud metadata endpoints, internal HTTP services, and other private network resources. The weakness is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Attackers can read cloud instance metadata, harvest temporary IAM credentials, and enumerate internal services reachable from the Flowise host.

Affected Products

Flowise versions prior to 3.1.4
Flowise Cheerio document loader node
Flowise Playwright and Puppeteer document loader nodes

Discovery Timeline

2026-09-15 - CVE-2026-91938 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91938

Vulnerability Analysis

Flowise exposes document loader nodes that accept a user-supplied URL and fetch the target content for downstream processing by language model chains. The Cheerio, Playwright, and Puppeteer loaders perform outbound HTTP requests without applying the platform's SSRF allow-list controls. As a result, the loaders honor URLs pointing to loopback interfaces, RFC 1918 ranges, link-local addresses, and cloud provider metadata services. Response bodies are returned to the caller as document text, giving the attacker a direct read primitive over any resource reachable from the Flowise host. The vulnerability requires low privileges but no user interaction.

Root Cause

The loaders invoke underlying HTTP and headless-browser clients directly rather than routing requests through the shared SSRF-protected fetcher. Missing hostname resolution checks, missing IP range denylists, and no redirect validation allow arbitrary internal destinations to be reached.

Attack Vector

An authenticated user with permission to build or modify a Flowise flow adds a Cheerio, Playwright, or Puppeteer document loader node and configures a target URL such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ on AWS, http://metadata.google.internal/ on GCP, or an internal service URL like http://localhost:8080/admin. When the flow executes, Flowise fetches the URL server-side and surfaces the raw response as document content, which the attacker retrieves through the flow output.

No verified public proof-of-concept code is available. Technical details are documented in the GitHub Security Advisory GHSA-9cvr-5wv9-2gxr and the VulnCheck Advisory for Flowise.

Detection Methods for CVE-2026-91938

Indicators of Compromise

Outbound HTTP requests from the Flowise process to 169.254.169.254, metadata.google.internal, or metadata.azure.com.
Flowise application logs showing document loader executions with URLs targeting loopback, private, or link-local IP ranges.
Unexpected reads of cloud IAM credential endpoints followed by API calls from new source IPs using those temporary credentials.

Detection Strategies

Inspect Flowise flow definitions for Cheerio, Playwright, or Puppeteer loader nodes referencing internal or metadata URLs.
Correlate egress network telemetry from the Flowise host against a denylist of internal CIDR ranges and cloud metadata addresses.
Alert on headless-browser processes (chromium, chrome, node) spawned by Flowise that initiate connections to RFC 1918 destinations.

Monitoring Recommendations

Forward Flowise application, container, and network flow logs to a centralized analytics platform for retrospective search.
Monitor cloud audit logs (AWS CloudTrail, GCP Audit Logs, Azure Activity Log) for use of instance-role credentials from unexpected principals or IPs.
Track version strings of deployed Flowise instances and alert when running builds fall below 3.1.4.

How to Mitigate CVE-2026-91938

Immediate Actions Required

Upgrade all Flowise deployments to version 3.1.4 or later.
Rotate any cloud IAM credentials, API keys, or session tokens accessible from the Flowise host's metadata service.
Restrict Flowise console access to trusted operators and enforce strong authentication on all accounts that can author flows.

Patch Information

The issue is fixed in Flowise 3.1.4. Refer to the GitHub Security Advisory GHSA-9cvr-5wv9-2gxr for the fix commit and release notes.

Workarounds

Block egress from the Flowise host to 169.254.169.254, metadata.google.internal, and other cloud metadata endpoints at the network or host firewall.
On AWS, enforce IMDSv2 with a hop limit of 1 to prevent metadata retrieval through the container or process layer.
Deploy Flowise behind an egress proxy that enforces an allow-list of external destinations and denies RFC 1918 and link-local ranges.
Disable or remove the Cheerio, Playwright, and Puppeteer document loader nodes if they are not required by production flows.

bash

# Example: enforce IMDSv2 with hop limit 1 on an EC2 instance hosting Flowise
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled