CVE-2026-69257: Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
Flowise’s HTTP security module (httpSecurity.ts) fails to normalize IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254) before checking them against the deny list. Due to an ipaddr.js kind mismatch (ipv6 vs ipv4), all IPv4 CIDR deny rules are silently skipped for IPv4-mapped IPv6 addresses. An attacker who controls DNS resolution for a hostname can set a AAAA record to ::ffff:<target_ipv4>, completely bypassing all SSRF protections and accessing internal services, cloud metadata endpoints, and localhost.
References
- github.com/FlowiseAI/Flowise/commit/0fc769208395641c1411ccdb9c81416e54802155
- github.com/FlowiseAI/Flowise/pull/6431
- github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3
- github.com/FlowiseAI/Flowise/security/advisories/GHSA-c6xh-wv4j-ppv5
- github.com/advisories/GHSA-c6xh-wv4j-ppv5
- nvd.nist.gov/vuln/detail/CVE-2026-69257
Code Behaviors & Features
Detect and mitigate CVE-2026-69257 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →