CVE-2026-43995: Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43995?
CVE-2026-43995 has been classified as a medium severity vulnerability.
How do I fix CVE-2026-43995?
To fix CVE-2026-43995, update Flowise to version 3.1.0 or later where the SSRF protection has been enforced.
What does CVE-2026-43995 exploit?
CVE-2026-43995 exploits the direct usage of HTTP clients like node-fetch and axios in Flowise, allowing for SSRF attacks.
Which versions of Flowise are affected by CVE-2026-43995?
Flowise versions before 3.1.0 are affected by CVE-2026-43995.
What is the impact of CVE-2026-43995?
The impact of CVE-2026-43995 includes unauthorized access to internal services and data via SSRF attacks.