Server-Side Request Forgery (SSRF) in Flowise - CVE-2026-91935
Published: September 1, 2026 / Updated: September 16, 2026
Vulnerability details
The vulnerability allows a remote user to perform server-side requests and disclose sensitive information, including LLM provider API keys.
The vulnerability exists due to server-side request forgery (SSRF) in chat-model nodes when processing user-controlled basepath or baseUrl values as the provider SDK baseURL. A remote user can create or update a chatflow with an attacker-controlled URL and trigger a prediction to perform server-side requests and disclose sensitive information, including LLM provider API keys.
The issue affects ChatOpenAICustom, both ChatOllama variants, ChatLocalAI, ChatLitellm, ChatNvdiaNIM, ChatNemoGuardrails, ChatCloudflareWorkersAI, and ChatGoogleGenerativeAI. The response from the outbound request can be returned through chat output, and the provider API key may be sent in the Authorization header. Publicly exposed prediction endpoints can broaden reach if a malicious chatflow is published.