What is CVE-2026-91938?

CVE-2026-91938 is a high-severity vulnerability in Flowiseai Flowise, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.1/10. Published 2026-09-15.

How severe is CVE-2026-91938?

High severity. CVSS v3 base score is 7.1 out of 10.

SSRF in Flowiseai Flowise

CVE-2026-91938

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response content returned as document text.

Vulnerability class: SSRF (Server-Side Request Forgery)

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L.

Affected products

Flowiseai Flowise

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-91938?: CVE-2026-91938 is a high-severity vulnerability in Flowiseai Flowise, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.1/10. Published 2026-09-15.
How severe is CVE-2026-91938?: High severity. CVSS v3 base score is 7.1 out of 10.