CVE-2026-91938 is a server-side request forgery vulnerability affecting FlowiseAI Flowise versions >=0 and <3.1.4. The issue exists in the Cheerio, Playwright, and Puppeteer document loader nodes, which fail to properly enforce SSRF protections. This allows an attacker with low privileges and no user interaction to provide arbitrary URLs that the server fetches, potentially exposing sensitive internal resources such as cloud metadata services and private network endpoints. The vulnerability has a CVSS 3.1 score of 7.1, indicating high impact on confidentiality and integrity with limited attack complexity.

Successful exploitation can lead to unauthorized access to internal and cloud metadata services, exposing sensitive information. Confidentiality and integrity impacts are high, while availability impact is low. Attackers can retrieve response content as document text, potentially enabling further attacks or information disclosure within the internal network environment.

A fixed version 3.1.4 or later is available that addresses this SSRF vulnerability. Users should upgrade Flowise to version 3.1.4 or newer to remediate this issue. No vendor advisory content was provided, but the affectedVersions field and description confirm the fix is in 3.1.4. Until upgrade, restrict access to the affected document loader nodes and limit network access to sensitive internal resources if possible.