CVE-2026-91938: Flowise: SSRF in web loaders exposes cloud metadata

HIGHPoC AVAILABLE

Published September 15, 2026

CISO Take

Flowise versions before 3.1.4 have a server-side request forgery flaw in the Cheerio, Playwright, and Puppeteer document loader nodes that bypasses the product's SSRF protection, letting an attacker make the server fetch arbitrary URLs and return the content as document text. The practical risk is theft of cloud instance metadata credentials and access to internal services that sit behind the perimeter. Near-term exploitation pressure is modest: EPSS is 0.37% (top 71%), it is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC says TRACK. The CVSS of 7.1 reflects high attack complexity and a required low-privilege account. Even so, Flowise instances commonly hold LLM API keys and cloud credentials, so a metadata leak can escalate quickly. Upgrade to Flowise 3.1.4 or later, enforce IMDSv2 or equivalent metadata protections, and restrict egress from Flowise hosts.

Sources:NVDEPSSGitHub Advisoryvulncheck.comATLASCISA SSVC

What is the risk?

Medium-high. Exploitation requires network access and a low-privilege account (PR:L), and the high attack complexity (AC:H) lowers the likelihood. There is no KEV listing, public exploit, or scanner template, and EPSS is low (0.37%, top 71%). The impact is high confidentiality and integrity loss because responses are returned verbatim, and cloud metadata endpoints can expose IAM credentials. Risk rises sharply for internet-exposed Flowise instances running on cloud VMs with permissive IAM roles or flat internal networks. Confidence: MEDIUM, because the advisory is the only source and no package or dependent data is available.

How does the attack unfold?

Initial Access

Attacker with a low-privilege account or access to a URL-accepting flow reaches the Flowise instance over the network.

AML.T0049

SSRF Exploitation

A crafted URL in a Cheerio, Playwright, or Puppeteer loader bypasses SSRF protection and makes the server fetch internal targets.

AML.T0049

Credential Discovery

The loader requests the cloud metadata service and returns temporary instance credentials as document text.

AML.T0055

Impact

Stolen credentials and internal data enable lateral movement into cloud resources and exposure of LLM provider keys.

AML.T0036

Initial Access

Attacker with a low-privilege account or access to a URL-accepting flow reaches the Flowise instance over the network.

AML.T0049

SSRF Exploitation

A crafted URL in a Cheerio, Playwright, or Puppeteer loader bypasses SSRF protection and makes the server fetch internal targets.

AML.T0049

Credential Discovery

The loader requests the cloud metadata service and returns temporary instance credentials as document text.

AML.T0055

Impact

Stolen credentials and internal data enable lateral movement into cloud resources and exposure of LLM provider keys.

AML.T0036

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CHigh

IHigh

ALow

What should I do?

1 step

1) Upgrade Flowise to 3.1.4 or later. 2) Until patched, disable or remove the Cheerio, Playwright, and Puppeteer loader nodes, or restrict who can create and edit flows that use them. 3) Enforce IMDSv2 with hop limit 1 (or the equivalent on GCP and Azure) and block access to metadata IPs from Flowise hosts and containers. 4) Apply egress filtering and network segmentation so Flowise cannot reach internal services, and use an allowlist of permitted domains where possible. 5) Rotate any cloud and LLM credentials that may have been exposed on potentially vulnerable instances. 6) Detection: review Flowise and proxy logs for loader requests to link-local, loopback, or RFC1918 addresses, DNS rebinding patterns, and unusual outbound requests to 169.254.169.254; review vector store contents for ingested internal data.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionData LeakageFrameworkAgentRAGAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0075- Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-91938?

Is CVE-2026-91938 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-91938, increasing the risk of exploitation.

How to fix CVE-2026-91938?

1) Upgrade Flowise to 3.1.4 or later. 2) Until patched, disable or remove the Cheerio, Playwright, and Puppeteer loader nodes, or restrict who can create and edit flows that use them. 3) Enforce IMDSv2 with hop limit 1 (or the equivalent on GCP and Azure) and block access to metadata IPs from Flowise hosts and containers. 4) Apply egress filtering and network segmentation so Flowise cannot reach internal services, and use an allowlist of permitted domains where possible. 5) Rotate any cloud and LLM credentials that may have been exposed on potentially vulnerable instances. 6) Detection: review Flowise and proxy logs for loader requests to link-local, loopback, or RFC1918 addresses, DNS rebinding patterns, and unusual outbound requests to 169.254.169.254; review vector store contents for ingested internal data.

What systems are affected by CVE-2026-91938?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, Low-code LLM workflow builders, Web scraping document ingestion, Cloud-hosted AI platforms.

What is the CVSS score for CVE-2026-91938?

CVE-2026-91938 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLow-code LLM workflow buildersWeb scraping document ingestionCloud-hosted AI platforms

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0075Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response content returned as document text.

Exploitation Scenario

An attacker with a low-privilege Flowise account, or access to an exposed flow that accepts a URL input, configures a Puppeteer or Cheerio loader to fetch an internal address, using a redirect or DNS trick to bypass the SSRF filter. They point it at the cloud metadata service and retrieve temporary IAM credentials, which the loader returns as document text in the flow output. With those credentials, they access cloud storage, secrets, and the LLM provider keys used by the AI platform. The same technique can enumerate internal services and pull data from private admin endpoints.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.