CVE-2026-91935 Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes
Authenticated users can exploit unvalidated baseURL parameters in chat model nodes to perform SSRF and exfiltrate LLM provider API keys.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-91935?
CVE-2026-91935 is a high-severity server-side request forgery vulnerability in FlowiseAI Flowise, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata services or internal hosts.
Weakness: CWE-918
Which versions are affected by CVE-2026-91935?
How do I fix CVE-2026-91935?
No fix has been published for CVE-2026-91935 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-91935 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-91935 exists.
Sources
Also known as GHSA-53c2-xvwj-6727, GHSA-hx55-h48h-7rw9.