CVE-2026-69257
Received Received - Intake

IPv4-Mapped IPv6 Bypass in Flowise

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list. Because ipaddr.js reports these addresses as ipv6 while IPv4 CIDR deny-list entries are ipv4, isDeniedIP() skipped the IPv4 CIDR checks. An attacker who controls DNS resolution for a hostname used by the HTTP Node, API Chain, Document Loader, MCP tool, or other paths using secureAxiosRequest(), secureFetch(), or checkDenyList() could return a AAAA record for an IPv4-mapped target and cause requests to reach localhost, internal services, or cloud metadata endpoints. This issue is fixed in version 3.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-69257
EUVD
EUVD-2026-52751

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flowiseai flowise 3.1.3
flowiseai flowise to 3.1.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-1389 The product parses numeric input assuming base 10 (decimal) values, but it does not account for inputs that use a different base number (radix).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-69257 is a Server-Side Request Forgery (SSRF) vulnerability in Flowise versions up to 3.1.2. The HTTP security module failed to normalize IPv4-mapped IPv6 addresses like ::ffff:127.0.0.1 before checking them against deny lists. This caused IPv4 CIDR rules to be skipped due to a type mismatch, allowing attackers to bypass SSRF protections by returning a AAAA record pointing to an IPv4-mapped IPv6 address.

Detection Guidance

To detect this vulnerability, check if your Flowise instance is running a version prior to 3.1.3. Use commands like 'npm list flowise' or inspect the version in the application interface. Monitor network logs for unexpected connections to localhost, internal services, or cloud metadata endpoints (e.g., 169.254.169.254). Test DNS resolution for domains resolving to IPv4-mapped IPv6 addresses like ::ffff:127.0.0.1.

Impact Analysis

An attacker could exploit this to access internal services, cloud metadata endpoints (like AWS metadata), or localhost. This may lead to credential theft, unauthorized access, or data exfiltration. The vulnerability affects all paths using SSRF protection functions such as HTTP Nodes, API Chains, and Document Loaders.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal services, cloud metadata endpoints, or localhost. For GDPR, this may result in unauthorized data access or processing, violating principles of lawfulness and security. For HIPAA, exposure of internal services could compromise protected health information confidentiality.

Mitigation Strategies

Upgrade Flowise to version 3.1.3 or later immediately. If upgrading is not possible, manually normalize IPv4-mapped IPv6 addresses in the httpSecurity.ts file or add ::ffff:0:0/96 to the deny list. Review and update SSRF protection rules to ensure proper handling of mapped addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69257. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart