Flowise
CVE-2026-43995
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.
AnalysisAI
Flowise versions prior to 3.1.0 allow authenticated remote attackers to bypass SSRF protections by exploiting direct HTTP client imports in four tool implementations (OpenAPIToolkit, WebScraperTool, MCP, and Arxiv) that circumvent the centralized httpSecurity.ts validation wrapper. An attacker with tool access can craft requests to reach blocked internal endpoints such as AWS metadata services, restoring full SSRF capability despite administrative deny-list configuration.
Technical ContextAI
Flowise implements centralized SSRF protection through httpSecurity.ts, which validates outbound HTTP requests against a deny-list (HTTP_DENY_LIST), performs IP resolution validation, enforces IP pinning, and blocks loopback addresses. However, four tool implementations-OpenAPIToolkit.ts, WebScraperTool.ts, MCP/core.ts, and Arxiv/core.ts-directly import HTTP clients (node-fetch, axios) rather than invoking the security wrapper, creating an enforcement gap. This is classified as CWE-918 (SSRF) and represents an architectural failure where security validation depends on voluntary wrapper usage rather than mandatory structural enforcement. The root cause is the absence of a global interceptor or centralized enforcement mechanism that prevents direct HTTP library imports.
RemediationAI
Upgrade Flowise to version 3.1.0 or later immediately. For organizations unable to upgrade immediately, disable vulnerable tools (OpenAPIToolkit, WebScraperTool, MCP, Arxiv) in tool configuration until patched. Additionally, enforce strict HTTP_DENY_LIST configuration blocking internal IP ranges (169.254.0.0/16 for AWS metadata, 127.0.0.0/8 for loopback, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 for private networks) at the network firewall or WAF level as a compensating control; however, this does not address the root architectural flaw and should be combined with the patch. For defense in depth, restrict LLM tool access to non-sensitive prompts and monitor outbound HTTP requests for requests to metadata endpoints or internal services. See https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c for patch details.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise pr
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today