Executive brief
Flowise is an open-source platform for building conversational AI chatbots using large language models. The vulnerability allows authenticated users with standard permissions to redirect LLM API requests to arbitrary servers, enabling theft of API keys and internal network reconnaissance. An attacker can create or edit chatflows to intercept credentials and exfiltrate sensitive authentication tokens used to communicate with LLM providers.
Technical details
Flowise chat-model nodes (ChatOpenAICustom, ChatOllama, ChatLocalAI, ChatLitellm, ChatNvdiaNIM, ChatNemoGuardrails, ChatCloudflareWorkersAI, ChatGoogleGenerativeAI) accept user-controlled baseURL/basepath parameters and pass them directly to underlying LangChain SDKs without validation, bypassing Flowise's httpSecurity module. The vulnerability is a Server-Side Request Forgery (CWE-918) combined with credential exfiltration; when a chatflow is executed, the Flowise server makes HTTP requests to the attacker-supplied URL with the LLM provider's API key in the Authorization header. An authenticated attacker with chatflows:create or chatflows:update permissions (default for non-admin team members) can target cloud metadata services (169.254.169.254), RFC1918 ranges, or internal hosts to steal credentials. Patches are available in version 3.1.4 and later.
Affected products
- FlowiseAI Flowise before 3.1.4
- FlowiseAI flowise-components before 3.1.4
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory GHSA-hx55-h48h-7rw9 published
- 2026-09-15: advisory: CVE-2026-91935 published on NVD
- 2026-08-31: patched: Version 3.1.4 released with patches