Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L P L N H H L 7.6 .0043 34.8 —
AFFECTED Product Versions Fixed Flowise < 3.1.3 – —
TIMELINE Aug 3 Reserved by GitHub_M Aug 4 Published (CNA: GitHub_M) Sep 14 EXPLOIT PUBLISHED — CVE-2026-69257 (FlowiseAI Flowise). Public exploit reference added.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list. Because ipaddr.js reports these addresses as ipv6 while IPv4 CIDR deny-list entries are ipv4, isDeniedIP() skipped the IPv4 CIDR checks. An attacker who controls DNS resolution for a hostname used by the HTTP Node, API Chain, Document Loader, MCP tool, or other paths using secureAxiosRequest(), secureFetch(), or checkDenyList() could return a AAAA record for an IPv4-mapped target and cause requests to reach localhost, internal services, or cloud metadata endpoints. This issue is fixed in version 3.1.3.
| Date | Event | Detail |
|---|---|---|
| August 3, 2026 | Reserved | Reserved by GitHub_M |
| August 4, 2026 | Published | Published (CNA: GitHub_M) |
| September 14, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-69257 (FlowiseAI Flowise). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| FlowiseAI | Flowise | — | < 3.1.3 | — |
Authoritative record: CVE-2026-69257 at cve.org
Vendors: flowiseai
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-69257 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
