Flowise IP deny-list bypass via IPv4-mapped IPv6 addresses

high severity · published 2026-08-04

An attacker who controls DNS resolution for a hostname used by the HTTP Node, API Chain, Document Loader, MCP tool, or other secureAxiosRequest and secureFetch paths can reach addresses on the deny list that should have been blocked. The deny-list check misses IPv4-mapped IPv6 addresses, so internal services and endpoints it was meant to protect become reachable.

Fixed in: 3.1.3

CVE: CVE-2026-69257

Source: NVD

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 116 and your operating system.