Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

## Summary Flowise's HTTP security module (`httpSecurity.ts`) fails to normalize IPv4-mapped IPv6 addresses (e.g., `::ffff:127.0.0.1`, `::ffff:169.254.169.254`) before checking them against the deny list. Due to an `ipaddr.js` kind mismatch (`ipv6` vs `ipv4`), all IPv4 CIDR deny rules are silently skipped for IPv4-mapped IPv6 addresses. An attacker who controls DNS resolution for a hostname can set a AAAA record to `::ffff:<target_ipv4>`, completely bypassing all SSRF protections and accessing internal services, cloud metadata endpoints, and localhost. ## CWE - **CWE-918**: Server-Side Request Forgery (SSRF) - **CWE-1389**: Incorrect Parsing of Numbers with Different Radices (IPv4-mapped IPv6 not normalized to IPv4 before deny list check) ## Affected Versions - All versions up to and including **v3.1.1** (latest main branch as of 2026-04-03) - This includes versions where CVE-2026-31829 was supposedly patched (v3.0.13+) ## Details ### Root Cause The `isDeniedIP()` function in `packages/components/src/httpSecurity.ts` checks IP addresses against a deny list using `ipaddr.js`. The critical flaw is in the `kind()` comparison: ```typescript // httpSecurity.ts - isDeniedIP() export function isDeniedIP(ip: string, denyList: string[]): void { const parsedIp = ipaddr.parse(ip); for (const entry of denyList) { if (entry.includes('/')) { try { const [range, _] = entry.split('/') const parsedRange = ipaddr.parse(range) // ⚠️ BUG: IPv4-mapped IPv6 has kind='ipv6', IPv4 CIDR has kind='ipv4' // This condition is FALSE for ::ffff:x.x.x.x vs any IPv4 CIDR entry if (parsedIp.kind() === parsedRange.kind()) { // <-- BYPASS HERE if (parsedIp.match(ipaddr.parseCIDR(entry))) { throw new Error('Access to this host is denied by policy.') } } } catch (error) { throw new Error(`isDeniedIP: ${error}`) } } else if (ip === entry) { throw new Error('Access to this host is denied by policy.') } } } ``` When the resolved IP is an IPv4-mapped IPv6 address like `::ffff:169.254.169.254`: - `ipaddr.parse('::ffff:169.254.169.254').kind()` returns `'ipv6'` - `ipaddr.parse('169.254.169.254').kind()` (from deny list entry) returns `'ipv4'` - `'ipv6' === 'ipv4'` is `false` → **CIDR check is completely skipped** The IPv6 deny list entries (`::1`, `fc00::/7`, `fe80::/10`, `ff00::/8`) do NOT cover the `::ffff:0:0/96` range where IPv4-mapped addresses live, so these addresses bypass ALL deny rules. ### Attack Vector 1. Attacker registers a domain (e.g., `evil.attacker.com`) and sets a **AAAA DNS record** to `::ffff:169.254.169.254` (AWS metadata) or `::ffff:10.0.0.1` (internal service) 2. Attacker configures a chatflow HTTP Node (or API Chain, Document Loader, etc.) to make a request to `http://evil.attacker.com/latest/meta-data/` 3. `resolveAndValidate()` calls `dns.lookup('evil.attacker.com', { all: true })` which returns `[{ address: '::ffff:169.254.169.254', family: 6 }]` 4. `isDeniedIP('::ffff:169.254.169.254', denyList)` is called , all IPv4 CIDR entries are skipped due to kind mismatch 5. Request is sent to `169.254.169.254` (AWS metadata service) via the IPv4-mapped IPv6 address ### Affected Endpoints All code paths using the SSRF protection functions are vulnerable: | Function | Usage Count | Affected Components | |----------|:-----------:|-------------------| | `secureAxiosRequest()` | 8+ | HTTP Node (Agentflow), ExecuteFlow, APILoader, FireCrawl, Spider, AzureRerank | | `secureFetch()` | 5+ | ApiChain, Custom Function sandbox, Jira tool, MCP tool | | `checkDenyList()` | 3+ | MCP Server URL validation, fetch-links service, web scraping | ### Proof of Concept ```javascript // Verify the bypass using ipaddr.js (same library Flowise uses) const ipaddr = require('ipaddr.js'); const denyLis

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Severity from

GitHub (reviewed advisory)

Weakness

CWE-1389, CWE-918

Also known as

CVE-2026-69257

• github.com/FlowiseAI/Flowise/security/advisories/GHSA-c6xh-wv4j-ppv5
• github.com/FlowiseAI/Flowise/pull/6431
• github.com/FlowiseAI/Flowise/commit/0fc769208395641c1411ccdb9c81416e54802155
• github.com/FlowiseAI/Flowise
• github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3