The flaw exists in Flowise versions prior to 3.1.0 where several tools—OpenAPIToolkit, WebScraperTool, MCP, and Arxiv—directly import and call raw HTTP clients such as node‑fetch and axios instead of the framework’s protected wrapper. This coding pattern permits the application to send HTTP requests to arbitrary URLs, consequently bypassing the built‑in SSRF safeguards. The weakness is classified as CWE‑918, and the CVSS base score of 5.3 indicates a moderate risk if the conditions for exploitation are met.

Flowise AI Flowise installations running any version earlier than 3.1.0 are vulnerable. The components that execute the direct HTTP calls are the OpenAPIToolkit, WebScraperTool, MCP, and Arxiv modules.

Because the vulnerability requires the application to process URLs that can be supplied by a user of the affected tools, an attacker who can influence those inputs may trigger outbound traffic to arbitrary endpoints. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, which suggests that no widespread exploitation has been observed. The CVSS score of 5.3 reflects that, while not trivial, it is not considered a high‑severity flaw.