THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-c6xh-wv4j-ppv5 (high) — Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

[GHSA] GHSA-c6xh-wv4j-ppv5 (high) — Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

highgithub_advisoriesPublished 2026-08-04

GHSA-c6xh-wv4j-ppv5 Severity: high CVE: CVE-2026-69257

Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

## Summary

Flowise's HTTP security module (`httpSecurity.ts`) fails to normalize IPv4-mapped IPv6 addresses (e.g., `::ffff:127.0.0.1`, `::ffff:169.254.169.254`) before checking them against the deny list. Due to an `ipaddr.js` kind mismatch (`ipv6` vs `ipv4`), all IPv4 CIDR deny

MITRE ATT&CK techniques

IP AddressesT1590.005
JavaScriptT1059.007
CredentialsT1589.001

Indicators of compromise

CVE-2026-69257cve
CVE-2026-31829cve
http://evil.attacker.com/latest/meta-data/`url
http://evil.com/latest/meta-data/iam/security-credentials/url
169.254.169.254/16cidr
169.254.0.0/16cidr
10.0.0.0/8cidr
127.0.0.0/8cidr
172.16.0.0/12cidr
192.168.0.0/16cidr

Original source: https://github.com/advisories/GHSA-c6xh-wv4j-ppv5