CVE-2026-91935: Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes
Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata services or internal hosts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.1.4 - Configuration
Upgrade to a version with SSRF protection (Flowise before 3.1.4 does not validate baseURL in chat-model nodes), so baseURL parameters cannot be used to redirect requests to cloud metadata services or internal hosts.
Flowise chat-model nodes baseURL parameter validation = validate baseURL to prevent redirects to arbitrary hosts (SSRF)
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Flowise user with either chatflows:create or chatflows:update permission can exploit it. The issue is exposed through chat-model nodes that accept a baseURL parameter.
What can an attacker do with successful exploitation?
An attacker can cause Flowise to send requests to arbitrary hosts, including internal services or cloud metadata endpoints. This can be used to exfiltrate LLM provider API keys.
Which versions are affected?
Flowise versions before 3.1.4 are affected. Upgrading to 3.1.4 or later addresses the affected version range described here.