CVE-2026-69257: Flowise SSRF Vulnerability

CVE-2026-69257 Overview

CVE-2026-69257 is a Server-Side Request Forgery (SSRF) vulnerability in Flowise, a drag-and-drop interface for building customized large language model (LLM) flows. The httpSecurity.ts module fails to normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before matching them against the configured deny list. Because ipaddr.js classifies these addresses as IPv6 while deny-list entries use IPv4 CIDR notation, isDeniedIP() bypasses IPv4 checks entirely. The issue affects all versions prior to 3.1.3 and is tracked under [CWE-918].

Critical Impact
An attacker controlling DNS for a hostname used by HTTP Node, API Chain, Document Loader, or MCP tools can return an AAAA record pointing to internal hosts, cloud metadata endpoints, or localhost services.

Affected Products

Flowise versions prior to 3.1.3
Any deployment invoking secureAxiosRequest(), secureFetch(), or checkDenyList()
Flowise components: HTTP Node, API Chain, Document Loader, and MCP tool integrations

Discovery Timeline

2026-08-04 - CVE-2026-69257 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-69257

Vulnerability Analysis

Flowise implements outbound HTTP request filtering to prevent SSRF attacks against internal infrastructure. The isDeniedIP() function in packages/components/src/httpSecurity.ts parses a target IP and compares it against a deny list containing CIDR ranges for private networks, loopback, and cloud metadata endpoints such as 169.254.169.254/32.

The flaw stems from inconsistent address family handling. When ipaddr.parse() receives an IPv4-mapped IPv6 address like ::ffff:127.0.0.1, it returns an IPv6 object. The deny-list CIDR entries are parsed as IPv4, so the family mismatch causes every comparison to short-circuit and return no match. The function then permits the request.

An attacker who controls DNS for an attacker-supplied hostname returns an AAAA record encoding the IPv4-mapped form of an internal target. Flowise resolves the hostname, receives the IPv6 address, passes the deny-list check, and dispatches the request to loopback, RFC1918 space, or 169.254.169.254.

Root Cause

The deny-list evaluator did not normalize IPv4-mapped IPv6 addresses to their canonical IPv4 form before CIDR matching. Address family mismatch between the parsed target and deny-list entries caused all IPv4 rules to be skipped for mapped inputs.

Attack Vector

Exploitation requires authenticated access to a Flowise node that performs outbound HTTP requests and control over DNS resolution for a hostname supplied to that node. The attacker configures an authoritative DNS server to return AAAA records containing IPv4-mapped IPv6 addresses targeting ::ffff:127.0.0.1, ::ffff:169.254.169.254, or internal service IPs. Flowise then issues the request against the internal endpoint, exposing responses to the attacker.

typescript

 * @throws Error if IP is in deny list
 */
export function isDeniedIP(ip: string, denyList: string[]): void {
-    const parsedIp = ipaddr.parse(ip)
+    let parsedIp = ipaddr.parse(ip)
+
+    // Normalize IPv4-mapped IPv6 addresses to IPv4 before checking
+    // This prevents bypass of IPv4 deny list rules via ::ffff:x.x.x.x addresses
+    if (parsedIp.kind() === 'ipv6') {
+        const ipv6Addr = parsedIp as ipaddr.IPv6
+        if (ipv6Addr.isIPv4MappedAddress()) {
+            parsedIp = ipv6Addr.toIPv4Address()
+        }
+    }
+
    for (const entry of denyList) {
        if (entry.includes('/')) {
            try {
-                const [range, _] = entry.split('/')
-                const parsedRange = ipaddr.parse(range)
+                const [rangeAddr, mask] = ipaddr.parseCIDR(entry)
+                let parsedRange = rangeAddr
+                let adjustedMask = mask
+
+                // Also normalize deny list entries
+                if (parsedRange.kind() === 'ipv6' && (parsedRange as ipaddr.IPv6).isIPv4MappedAddress()) {
+                    if (mask < 96) continue // malformed IPv4-mapped CIDR — skip
+                    parsedRange = (parsedRange as ipaddr.IPv6).toIPv4Address()
+                    adjustedMask -= 96
+                }

Source: GitHub Commit 0fc7692

Detection Methods for CVE-2026-69257

Indicators of Compromise

Outbound DNS queries from Flowise hosts resolving to AAAA records containing the ::ffff: prefix.
HTTP requests originating from Flowise that reach loopback interfaces, RFC1918 ranges, or the cloud metadata service at 169.254.169.254.
Access log entries on internal services showing the Flowise service account or workload identity as the source.
Newly created or modified HTTP Node, API Chain, or MCP tool configurations referencing external hostnames with attacker-controlled DNS.

Detection Strategies

Inspect Flowise application logs for outbound request targets containing IPv4-mapped IPv6 notation before the 3.1.3 upgrade.
Correlate egress proxy or NetFlow data with Flowise workload IPs to identify unexpected internal destinations, especially 169.254.169.254.
Deploy DNS monitoring to flag AAAA responses in the ::ffff:0:0/96 range delivered to Flowise resolvers.

Monitoring Recommendations

Enable full request logging on secureAxiosRequest() and secureFetch() code paths and forward to a central SIEM for retrospective analysis.
Add network-layer egress filtering that blocks traffic from Flowise workloads to metadata endpoints and internal subnets, independent of application controls.
Alert on any successful HTTP response from Flowise targeting the Instance Metadata Service (IMDS) endpoints of AWS, Azure, or GCP.

How to Mitigate CVE-2026-69257

Immediate Actions Required

Upgrade Flowise to version 3.1.3, which normalizes IPv4-mapped IPv6 addresses before deny-list evaluation.
Restrict outbound network access from Flowise workloads using host firewall rules or a network policy that blocks RFC1918, loopback, and link-local ranges.
Enforce IMDSv2 with hop-limit 1 on cloud instances hosting Flowise to prevent metadata credential theft even if SSRF succeeds.
Audit existing flows for HTTP Node, API Chain, Document Loader, and MCP tool configurations that accept user-supplied URLs.

Patch Information

The fix is available in Flowise 3.1.3. See GitHub Release v3.1.3, Pull Request #6431, and GHSA-c6xh-wv4j-ppv5 for details. The patch updates isDeniedIP() to convert IPv4-mapped IPv6 addresses via toIPv4Address() prior to CIDR comparison, and also normalizes deny-list CIDR entries expressed in IPv4-mapped form.

Workarounds

Place Flowise behind an outbound HTTP proxy that terminates connections to private IP ranges and metadata endpoints regardless of address family.
Disable or restrict access to HTTP Node, API Chain, Document Loader, and MCP tool node types until the upgrade is applied.
Deploy Flowise in a segmented network with no route to internal services or cloud metadata IPs.

bash

# Upgrade to the patched version
npm install -g flowise@3.1.3

# Verify installed version
flowise --version

# Optional: block IPv4-mapped IPv6 loopback and metadata at the host level (Linux ip6tables)
ip6tables -A OUTPUT -d ::ffff:127.0.0.0/104 -j REJECT
ip6tables -A OUTPUT -d ::ffff:169.254.169.254/128 -j REJECT
ip6tables -A OUTPUT -d ::ffff:10.0.0.0/104 -j REJECT
ip6tables -A OUTPUT -d ::ffff:172.16.0.0/108 -j REJECT
ip6tables -A OUTPUT -d ::ffff:192.168.0.0/112 -j REJECT