Loading vulnerability…
Flowise IPv4-Mapped IPv6 SSRF Protection Bypass
CVE-2026-69257 is a server-side request forgery vulnerability in Flowise before version 3.1.3. Flowise's HTTP security logic failed to normalize IPv4-mapped IPv6 addresses before applying IPv4 CIDR deny-list validation. Because the address-parsing library classified mapped addresses as IPv6, the deny-list routine skipped IPv4 range checks. This affects Flowise request paths including HTTP Node, API Chain, Document Loader, MCP tooling, and other features using the centralized secure request and deny-list validation functions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can bypass SSRF restrictions and induce Flowise to send requests to loopback interfaces, internal network services, and cloud instance metadata services. This may expose credentials, service-account tokens, sensitive application data, and internal administrative APIs, databases, or services accessible from the Flowise deployment.
If you can’t patch tonight, do this now.
Until upgrades are complete, normalize IPv4-mapped IPv6 addresses before evaluating deny-list rules. As defense in depth, block mapped IPv6 address space and mapped loopback, private, link-local, and metadata-address ranges; restrict Flowise outbound network access with network-level egress controls; and prevent untrusted users from controlling DNS resolution for request destinations.
Patch, then assume compromise.
Upgrade Flowise to version 3.1.3 or later. The fix normalizes IPv4-mapped IPv6 addresses to their IPv4 representation before deny-list evaluation. Implementations should also normalize resolved addresses consistently before validation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.