IP Address Normalization Flaw in Flowise Affects User Security

CVE-2026-69257

What is CVE-2026-69257?

Flowise, a user-friendly interface designed for building customized large language model workflows, has a critical flaw in its HTTP security module prior to version 3.1.3. The module fails to properly normalize IPv4-mapped IPv6 addresses, which may allow malicious actors to bypass IP deny-list checks. By manipulating DNS resolution for services utilizing Flowise, an attacker could redirect requests to internal services or cloud metadata endpoints, endangering the infrastructure. The issue has been addressed in the latest update, ensuring enhanced security for users.

References