CVE-2026-43995 | FlowiseAI Flowise up to 3.0.12 Custom MCP validateMCPServerConfig server-side request forgery

A vulnerability was found in FlowiseAI Flowise up to 3.0.12. It has been rated as critical. This issue affects the function validateMCPServerConfig of the component Custom MCP Component. The manipulation leads to server-side request forgery.

This vulnerability is uniquely identified as CVE-2026-43995. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Upgrading the affected component is advised.