{"id":"CVE-2026-43995","revision":null,"records":[{"revision":"6bc3b1b35a8d4879948440af74b27979","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-43995","aliases":[],"title":"Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)","description":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.","state":0,"publishedAt":"2026-05-11T17:49:42.189+00:00","modifiedAt":"2026-05-11T18:21:09.537+00:00","affected":[{"ecosystem":"Vendor product","name":"Flowise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"FlowiseAI\",\n                    \"product\": \"Flowise\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.1.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43995","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-43995","identifiers":["CVE-2026-43995"]},"retained":false,"historicalAffected":[]},{"revision":"e4c8568c01fc48a8af7b74593a2bc8b3","observedAt":"2026-11-07T09:37:41.051+00:00","statement":{"source":"euvd","id":"EUVD-2026-29175","aliases":["CVE-2026-43995","GHSA-qqvm-66q4-vf5c"],"title":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. The…","description":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","score":5.3,"severity":null}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29175","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 11, 2026, 5:49:42 PM","dateUpdated":"May 11, 2026, 6:21:09 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-29175","identifiers":["EUVD-2026-29175","CVE-2026-43995","GHSA-qqvm-66q4-vf5c"]},"retained":false,"historicalAffected":[]},{"revision":"a249e9fa30bc417a9a9b805ab6050ae3","observedAt":"2026-10-27T11:12:09.678+00:00","statement":{"source":"nvd","id":"CVE-2026-43995","aliases":[],"title":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. The…","description":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.","state":0,"publishedAt":"2026-05-11T18:16:37.66+00:00","modifiedAt":"2026-10-26T18:10:00.173+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43995","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-918"],"productCriteria":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-05-11T18:16:37.660","lastModified":"2026-10-26T18:10:00.173"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-43995","identifiers":["CVE-2026-43995"]},"retained":false,"historicalAffected":[]},{"revision":"caea66d6fa934f499d39dbb34cf9f28b","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-qqvm-66q4-vf5c","aliases":["CVE-2026-43995"],"title":"Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)","description":"### Summary\n\nFlowise introduced SSRF protections through a centralized HTTP security wrapper (`httpSecurity.ts`) that implements deny-list validation and IP pinning logic.\n\nHowever, multiple tool implementations directly import and invoke raw HTTP clients (`node-fetch`, `axios`Instead of using the secured wrapper.\n\nBecause enforcement is neither mandatory nor centralized, these tools bypass SSRF mitigation entirely, restoring full SSRF capability even after the patch.\n\nThis issue is distinct from specification trust issues and represents incomplete mitigation of previously addressed SSRF vulnerabilities.\n\n### Details\n**Intended Security Model:**\n\nAll outbound HTTP requests should pass through the centralized validation layer implemented in:\n\n```\npackages/components/src/httpSecurity.ts\n```\n\nThis layer performs:\n\n- `HTTP_DENY_LIST` enforcement\n- IP resolution validation\n- IP pinning\n- Loopback blocking\n\n**Observed Implementation Gap:**\n\nMultiple tools bypass this layer and import HTTP libraries directly.\n\nExamples include:\n\n- `packages/components/nodes/tools/OpenAPIToolkit/OpenAPIToolkit.ts`\n- `packages/components/nodes/tools/WebScraperTool/WebScraperTool.ts`\n- `packages/components/nodes/tools/MCP/core.ts`\n- `packages/components/nodes/tools/Arxiv/core.ts`\n\nThese files directly execute:\n\n```\nimportfetchfrom'node-fetch'\n```\n\nor invoke `axios` without passing through the centralized validation wrapper.\n\nBecause there is no global interceptor or enforcement mechanism, outbound requests in these components are executed without SSRF validation.\n\nThis renders the mitigation introduced in GHSA-2x8m-83vc-6wv4 incomplete.\n\n### Root Cause\n\nSecurity enforcement is not centralized.\n\nOutbound request validation depends on voluntary usage of a wrapper function rather than being structurally enforced.\n\nBecause direct imports of HTTP clients are allowed, the mitigation is easily bypassed.\n\nThis is an architectural enforcement failure rather than a single implementation bug.\n\n### PoC\nEven when an administrator configures:\n\n```\nHTTP_DENY_LIST=169.254.0.0/16,127.0.0.0/8\n```\n\nThe following attack succeeds if a vulnerable tool is enabled:\n\n**Chat Prompt:**\n\n```\nUse the Web Scraper tool to retrieve:\nhttp://169.254.169.254/latest/meta-data/iam/security-credentials/\n```\n\nExecution flow:\n\n1. The LLM triggers `WebScraperTool`.\n2. The tool calls raw `fetch()` directly.\n3. No `httpSecurity.ts` validation is applied.\n4. The request reaches the metadata endpoint.\n5. The response is returned to the chat context.\n\nThis demonstrates that SSRF protection is opt-in rather than enforced.\n### Impact\n\n**Severity:** Critical (CVSS v3.1: 9.1 – AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nThis issue:\n\n- Completely bypasses the centralized SSRF mitigation.\n- Allows access to internal network resources.\n- Enables the exploitation of cloud metadata and credential theft.\n- Invalidates the security assumptions of the recent patch.\n\nAny deployment enabling affected tools remains vulnerable.\n\n### Recommended Remediation\n\n1. Refactor all tools to use the centralized `secureFetch()` wrapper.\n2. Add ESLint `no-restricted-imports` rules to prohibit the direct usage of `node-fetch` or `axios` in tool components.\n3. Consider implementing a single internal HTTP client abstraction layer.\n4. Apply network-level egress filtering as defense-in-depth.","state":0,"publishedAt":"2026-04-16T21:23:03+00:00","modifiedAt":"2026-05-13T14:17:49.296266+00:00","affected":[{"ecosystem":"npm","name":"flowise","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.1.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"flowise-components","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.1.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c","https://nvd.nist.gov/vuln/detail/CVE-2026-43995","https://github.com/FlowiseAI/Flowise"],"sourceUrl":"https://github.com/advisories/GHSA-qqvm-66q4-vf5c","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-qqvm-66q4-vf5c","identifiers":["GHSA-qqvm-66q4-vf5c","CVE-2026-43995"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T16:07:52.6079466+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T16:07:52.6079466+00:00","lastSuccessAt":"2026-11-07T16:07:52.8396759+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.8396778+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-c173d89a3f1a0bdb31cd68e866be332a5016302f586ede89a35ec193ac99504a","complete":true,"records":420933,"lastAttemptAt":"2026-11-07T16:07:52.127477+00:00","lastSuccessAt":"2026-11-07T16:07:52.0557652+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.127477+00:00","snapshotPublishedAt":"2026-11-07T15:22:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-bee3dfbd77fe4043986590b0e0b76259","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T16:18:44.6437051+00:00","lastSuccessAt":"2026-11-07T16:18:44.639+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:18:44.639+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T16:07:52.6079466+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T16:07:52.6079466+00:00","lastSuccessAt":"2026-11-07T16:07:58.5710341+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:58.5710358+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e1c431e1022f4db1b4e459e61c31a4ca","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T16:08:00.6485737+00:00","lastSuccessAt":"2026-11-07T16:08:00.644+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:08:00.644+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T16:07:52.5107257+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.5107257+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T16:07:52.2947928+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.2947928+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T16:07:52.5258708+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.5258708+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T16:07:52.4004477+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.4004477+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}