MCPA-2026-0027
highssrf
Flowise SSRF protection bypass via IPv4-mapped IPv6 addresses (CVE-2026-69257)
Flowise 3.1.2 and earlier fail to normalize IPv4-mapped IPv6 addresses (e.g. ::ffff:169.254.169.254) before checking the SSRF deny list in httpSecurity.ts; an ipaddr.js kind mismatch silently skips all IPv4 CIDR deny rules for such addresses. An attacker controlling DNS (AAAA record to ::ffff:<target>) bypasses all SSRF protections and reaches internal services, cloud metadata endpoints, and localhost. Fixed in 3.1.3.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | flowise | >= 0, < 3.1.3 |
Identifiers
CVE-2026-69257GHSA-c6xh-wv4j-ppv5CWE-918
References
- advisory https://github.com/advisories/GHSA-c6xh-wv4j-ppv5
- advisory https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c6xh-wv4j-ppv5
- web https://nvd.nist.gov/vuln/detail/CVE-2026-69257
Timeline
- Published: 2026-08-04