Is there a patch available for CVE-2026-43995?

Yes, a patch is available for CVE-2026-43995. Update the affected software to the latest version immediately.

Flowise CVE-2026-43995

Q: What is the CVSS score of CVE-2026-43995?

CVE-2026-43995 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-11 GitHub_M

SSRF Flowise

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 11, 2026 - 18:48 vuln.today

Analysis Generated

May 11, 2026 - 18:48 vuln.today

CVSS changed

May 11, 2026 - 18:22 NVD

5.3 (MEDIUM)

CVE Published

May 11, 2026 - 17:49 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.

AnalysisAI

Flowise versions prior to 3.1.0 allow authenticated remote attackers to bypass SSRF protections by exploiting direct HTTP client imports in four tool implementations (OpenAPIToolkit, WebScraperTool, MCP, and Arxiv) that circumvent the centralized httpSecurity.ts validation wrapper. An attacker with tool access can craft requests to reach blocked internal endpoints such as AWS metadata services, restoring full SSRF capability despite administrative deny-list configuration.

Technical ContextAI

Flowise implements centralized SSRF protection through httpSecurity.ts, which validates outbound HTTP requests against a deny-list (HTTP_DENY_LIST), performs IP resolution validation, enforces IP pinning, and blocks loopback addresses. However, four tool implementations-OpenAPIToolkit.ts, WebScraperTool.ts, MCP/core.ts, and Arxiv/core.ts-directly import HTTP clients (node-fetch, axios) rather than invoking the security wrapper, creating an enforcement gap. This is classified as CWE-918 (SSRF) and represents an architectural failure where security validation depends on voluntary wrapper usage rather than mandatory structural enforcement. The root cause is the absence of a global interceptor or centralized enforcement mechanism that prevents direct HTTP library imports.

RemediationAI

Upgrade Flowise to version 3.1.0 or later immediately. For organizations unable to upgrade immediately, disable vulnerable tools (OpenAPIToolkit, WebScraperTool, MCP, Arxiv) in tool configuration until patched. Additionally, enforce strict HTTP_DENY_LIST configuration blocking internal IP ranges (169.254.0.0/16 for AWS metadata, 127.0.0.0/8 for loopback, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 for private networks) at the network firewall or WAF level as a compensating control; however, this does not address the root architectural flaw and should be combined with the patch. For defense in depth, restrict LLM tool access to non-sensitive prompts and monitor outbound HTTP requests for requests to metadata endpoints or internal services. See https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c for patch details.