CVE-2026-43995CWE-918

Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

Medium · published May 11, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00484 · 40.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-11T17:49Z
EPSS history
Timeline
  • 11 MAY 17:49Z
    Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
    cvelistv5