PT-2026-67768

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description Flowise contains a Server-Side Request Forgery SSRF flaw in its HTTP security module httpSecurity.ts. The isDeniedIP function fails to normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 or...

CVE-2026-69257: Server-Side Request Forgery (SSRF)

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list...

CVE-2026-41272: Server-Side Request Forgery (SSRF)

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers secureAxiosRequest and secureFetch intended to prevent Server-Side Request Forgery SSRF contain multiple logic flaws. These flaws allow attackers to bypass the...

PT-2026-35288

Summary The core security wrappers secureAxiosRequest and secureFetch intended to prevent Server-Side Request Forgery SSRF contain multiple logic flaws. These flaws allow attackers to bypass the allow/deny lists via DNS Rebinding Time-of-Check Time-of-Use or by exploiting the default configuratio...