CVE-2026-69258 in Flowise
Summary
by MITRE • 08/04/2026
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in packages/server/src/utils/buildChatflow.ts and packages/server/src/utils/index.ts without checking apiOverrideStatus. This allowed unauthenticated attackers to inject arbitrary properties into the flow execution context of any public chatflow, overwrite values such as chatId, sessionId, and chatHistory, and control values resolved through $flow.* template variables consumed by flow nodes. This issue is fixed in version 3.1.3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability in Flowise versions prior to 3.1.3 represents a critical authorization bypass and arbitrary code execution risk that stems from improper input validation within the chatflow prediction endpoint. The flaw exists in the unauthenticated POST endpoint at /api/v1/prediction/:id where the system accepts an overrideConfig object without proper authentication checks or parameter validation. This design oversight allows attackers to inject malicious configuration data directly into the internal flow execution context through the buildChatflow.ts and index.ts utility files in the server package.
The technical implementation of this vulnerability occurs when the system unconditionally spreads the overrideConfig object into both flowConfig and flowData objects without verifying whether apiOverrideStatus is enabled or checking if the request originates from an authenticated source. This blind spreading operation creates a path for attackers to manipulate critical execution parameters that control how chatflows process user inputs. The impact extends beyond simple data manipulation as attackers can overwrite essential identifiers such as chatId, sessionId, and chatHistory, which fundamentally alters the flow execution behavior.
The operational consequences of this vulnerability are severe as it enables attackers to completely subvert the intended flow of chatbot conversations by controlling template variables resolved through $flow.* patterns. This allows adversaries to manipulate the context in which flow nodes execute, potentially leading to information disclosure, session hijacking, or even arbitrary command execution depending on how the flow nodes are configured. The vulnerability affects all public chatflows since no authentication is required to exploit the endpoint, making it particularly dangerous for deployments where chatbots are exposed to untrusted users.
From a cybersecurity perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and CWE-94 (Improper Control of Generation of Code) as it allows unauthorized modification of execution parameters and potentially enables code injection through template variable manipulation. The ATT&CK framework categorizes this under T1078 (Valid Accounts) and T1566 (Phishing) as attackers could leverage this vulnerability to establish persistent access or manipulate data flows in ways that could compromise downstream systems. Organizations using Flowise versions before 3.1.3 should immediately implement mitigations including disabling public chatflows when not required, implementing proper authentication mechanisms, and restricting network access to the prediction endpoints.
The fix implemented in version 3.1.3 addresses this vulnerability by introducing proper apiOverrideStatus checks that validate whether overrideConfig parameters are permitted before applying them to internal flow objects. This change ensures that only authenticated users with appropriate permissions can modify execution parameters, preventing unauthorized manipulation of chatflow behavior. System administrators should verify that all Flowise deployments have been updated to version 3.1.3 or later and conduct security audits to confirm that no unauthorized modifications have occurred during the vulnerability window. Additionally, monitoring should be implemented to detect unusual patterns in prediction endpoint usage that might indicate exploitation attempts.