Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck
CVE-2026-91938Flowise before 3.1.4 Server-Side Request Forgery via document loaders
High 7.1
In plain English
A high-severity server-side request forgery in Flowise from FlowiseAI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 68.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response content returned as document text.
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
References
- GitHub Security Advisory (GHSA-9cvr-5wv9-2gxr) vendor-advisory
- VulnCheck Advisory: Flowise before 3.1.4 Server-Side Request Forgery via document loaders third-party-advisory