CVE-2026-91938

Executive Summary

CVE-2026-91938 is a server-side request forgery (SSRF) vulnerability in Flowise versions before 3.1.4, specifically within the Cheerio, Playwright, and Puppeteer document loader nodes. The flaw allows an authenticated attacker to bypass existing SSRF protections and supply arbitrary URLs, causing the server to fetch cloud metadata endpoints, internal services, and private network resources, with the fetched response content returned to the attacker as document text. Successful exploitation enables credential theft, internal network reconnaissance, and potential lateral movement within the hosting environment.

Technical Analysis

Flowise is a low-code/visual tool for building LLM orchestrations and agentic workflows. Its document loader nodes ingest external content for retrieval-augmented generation (RAG) pipelines. The Cheerio, Playwright, and Puppeteer loader nodes are designed to retrieve and parse web documents. According to the NVD description, these loader nodes contain a server-side request forgery vulnerability that "bypass[es] SSRF protection."

SSRF (CWE-918) arises when an application accepts a user-supplied URL and performs a server-side request without adequate validation of the destination. In this case, the intended protection mechanism for the document loaders is bypassed, allowing the attacker to direct requests to arbitrary hosts. Because the affected nodes return the fetched content as document text, the SSRF is not blind — the attacker receives the response body, which materially increases exploitability.

The three affected loader families differ in mechanism:

• Cheerio performs HTTP retrieval plus HTML parsing (no browser engine).
• Playwright and Puppeteer drive headless browser engines, which may reach resources beyond a simple HTTP client (e.g., alternate schemes, DNS-based tricks, redirect chains).

The exact bypass technique (redirect handling, DNS rebinding, IP-address encoding, allowlist parsing flaw, or scheme confusion) is not specified in the provided description. It is therefore reported here at the vulnerability-class level only; no implementation-specific function names, parameters, or endpoints are asserted.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L reflects: network access (AV:N), high attack complexity (AC:H, consistent with constructing a bypass), low privileges required (PR:L, i.e., an authenticated user with the ability to configure/execute loader nodes), no user interaction (UI:N), unchanged scope (S:U), high confidentiality and integrity impact (C:H/I:H), and low availability impact (A:L). Base score: 7.1 (High).

Patch confidence is 2/4 — a single source (OSV) claims a fix in 3.1.4, but no vendor advisory or independent confirmation was available.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code exists for CVE-2026-91938 (POC_STATUS: None). The following chain is inferred from the vulnerability class and the NVD description, not from published exploit code.

1. Reconnaissance / target identification. The attacker identifies a reachable Flowise instance (version < 3.1.4) via Shodan dorks or direct discovery, and confirms access sufficient to create or modify a workflow containing a document loader node. PR:L indicates the attacker requires some level of access to the platform (a low-privileged authenticated user able to configure flows).

2. Triggering the flaw class. The attacker configures a Cheerio, Playwright, or Puppeteer document loader node and supplies an arbitrary URL as the document source. Because the SSRF protection intended for these nodes is bypassed, the server processes the attacker-controlled URL and issues the request from the Flowise host itself.

3. Payload / execution method (vulnerability-class level). The attacker points the loader at sensitive internal destinations — for example, cloud instance metadata services or internal-only HTTP services. The standard SSRF target class includes cloud metadata endpoints used to retrieve temporary IAM credentials, and internal service URLs not reachable from the public internet. The precise request construction is not documented in the available data and is not fabricated here.

4. Post-exploitation impact. Per the NVD description, the fetched response content is "returned as document text," so the attacker reads the response bodies directly. This enables: theft of cloud instance credentials from metadata services, enumeration and response harvesting of private-network services, and use of the Flowise server as a pivot into segmented internal networks. With the integrity impact (I:H), the attacker may also influence ingested content used by downstream LLM/RAG pipelines.

Impact Assessment

Successful exploitation primarily affects confidentiality and integrity (C:H, I:H), with low availability impact (A:L), consistent with a base score of 7.1.

Affected systems: Any Flowise deployment running a version before 3.1.4 that exposes document loader nodes (Cheerio/Playwright/Puppeteer) to users with sufficient privileges. Cloud-hosted deployments are at elevated risk due to reachable instance metadata endpoints.

Business impact:

• Credential compromise: Metadata service responses frequently contain temporary cloud credentials, enabling broader cloud account access.
• Internal network exposure: Internal services (databases, admin panels, APIs) not internet-facing may be enumerated and their responses exfiltrated.
• Data exposure: Responses are returned as document text, allowing direct content theft.
• Lateral movement: The Flowise host becomes a pivot point into otherwise segmented networks.
• AI pipeline trust: Ingested content within RAG workflows could be manipulated, affecting downstream model outputs.

Blast radius: Bounded per instance but potentially large where Flowise runs with broad cloud IAM roles or has reachability to sensitive internal segments. EPSS is 0.00348 (28.2% percentile) and CISA KEV status is NO, indicating no confirmed in-the-wild exploitation at time of writing.

Detection Guidance

Detection should focus on outbound requests from the Flowise host to metadata endpoints, private IP ranges, and unusual destinations, correlated with document loader node activity. Because no exploit code is public, rules are heuristic and target the SSRF destination class rather than a specific payload string.

Sigma Rule

title: Flowise Document Loader SSRF Attempt (CVE-2026-91938)
id: 8f2c1a44-7b6e-4d2a-9c3f-1a2b3c4d5e6f
status: experimental
description: Detects outbound requests from Flowise document loader nodes to cloud metadata and private network ranges indicative of CVE-2026-91938 SSRF exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91938
author: valtersit.com
date: 2026-01-01
logsource:
  category: network_connection
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\node.exe'
  selection_dest:
    DestinationIp|cidr:
      - '169.254.169.254/32'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  condition: selection_proc and selection_dest
falsepositives:
  - Legitimate Flowise integrations deliberately targeting internal services
level: high
tags:
  - attack.t1190
  - cve.2026-91938

YARA Rule

rule CVE_2026_91938_Flowise_SSRF_Loader
{
    meta:
        description = "Detects Flowise document loader references to Cheerio/Playwright/Puppeteer nodes with suspicious URL targets"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91938"
        date = "2026-01-01"
        cve = "CVE-2026-91938"

    strings:
        $loader1 = "documentLoader" ascii nocase
        $loader2 = "Cheerio" ascii nocase
        $loader3 = "Playwright" ascii nocase
        $loader4 = "Puppeteer" ascii nocase
        $meta1   = "169.254.169.254" ascii
        $meta2   = "metadata.google.internal" ascii nocase
        $ver     = "3.1.4" ascii

    condition:
        uint16(0) == 0x0A0D or uint32(0) == 0x464C457F or true
        and
        (
          ($loader2 or $loader3 or $loader4) and ($meta1 or $meta2)
        )
        and not filesize > 20MB
}

Suricata IDS Rule

alert http $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-91938 Flowise Document Loader SSRF to Private Range"; flow:to_server,established; content:"GET"; http_method; pcre:"/(169\.254\.169\.254|metadata\.google\.internal)/Ui"; flowbits:noalert; sid:9901938; rev:1;)

Elastic Detection

network where process.name == "node" and
  (destination.ip in ("169.254.169.254", "127.0.0.1") or
   cidrMatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"))

Splunk SPL Query

index=network sourcetype=flow OR sourcetype=suricata
| search (dest_ip="169.254.169.254" OR dest_ip="metadata.google.internal" OR cidrmatch("10.0.0.0/8", dest_ip) OR cidrmatch("192.168.0.0/16", dest_ip))
| where process_name="node" OR url_path="*documentLoader*"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, dest_port, url_path
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="flowise,ssrf,cve-2026-91938,">
  <rule id="100938" level="12">
    <decoded_as>json</decoded_as>
    <field name="dest_ip">169\.254\.169\.254|127\.0\.0\.1|^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.</field>
    <field name="process">node</field>
    <description>CVE-2026-91938: Possible Flowise document loader SSRF to internal/metadata address</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The claimed fix is Flowise 3.1.4 or later, per OSV; no vendor advisory or CVE-specific remediation notes were available, and affected-version data in the supplied feed is empty.

1) Immediate mitigations:

• Restrict access to Flowise such that only trusted, authenticated users can create or edit workflows containing document loader nodes (PR:L implies an authenticated user is required).
• Enforce egress network controls (egress firewall / security group) blocking the Flowise host from reaching cloud metadata endpoints (e.g., 169.254.169.254) and unnecessary private network ranges.
• Where cloud providers support it, enforce IMDSv2 (session-token-required metadata access) to reduce the value of metadata retrieval.
• Monitor/alert on outbound requests to private CIDRs and metadata endpoints originating from Flowise hosts.

2) Patch/upgrade steps:

• Upgrade Flowise to version 3.1.4 or later, per the single-source (OSV) claim.
• Because the fix is not independently confirmed, verify the release notes of 3.1.4 for the SSRF bypass fix before relying on it; if unavailable, apply network-level mitigations regardless.
• After upgrade, retest that Cheerio, Playwright, and Puppeteer loader nodes enforce SSRF validation.

3) Long-term hardening:

• Implement destination allowlisting (default-deny) for document loader URLs, with strict parsing/redirect handling to prevent validation bypass.
• Run Flowise with least-privilege IAM roles, no access to sensitive metadata, and segmented network placement.
• Deploy outbound proxy inspection for all server-side fetches performed by Flowise.
• Maintain patch currency and monitor vendor advisories for confirmation of CVE-2026-91938 remediation.

References

• NVD — CVE-2026-91938: https://nvd.nist.gov/vuln/detail/CVE-2026-91938
• OSV (single-source patch claim, Flowise 3.1.4): https://osv.dev/
• MITRE CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-91938 not listed)

Note on threat intelligence: No public PoC, Nuclei template, or exploit code exists for CVE-2026-91938 as of this report. EPSS is 0.00348 (28.2% percentile) and CISA KEV status is NO, indicating no confirmed in-the-wild exploitation. No threat actor campaigns are associated with this CVE in the available data.