CVE-2026-43995 | FlowiseAI Flowise up to 3.0.12 OpenAPI Toolkit OpenAPIToolkit.ts loadOpenApiSpec server-side request forgery

A vulnerability categorized as critical has been discovered in FlowiseAI Flowise up to 3.0.12. Impacted is the function loadOpenApiSpec of the file packages/components/nodes/tools/OpenAPIToolkit/OpenAPIToolkit.ts of the component OpenAPI Toolkit. The manipulation results in server-side request forgery.

This vulnerability was named CVE-2026-43995. The attack may be performed from remote. In addition, an exploit is available.

It is advisable to upgrade the affected component.