CVE-2026-69258: Flowise property injection in Prediction API

Executive brief

Flowise, an open-source tool for building AI workflows, contains a vulnerability in its prediction interface. An unauthenticated attacker can send specially crafted requests to take over other users' chat sessions, view private conversation histories, or manipulate the AI's behavior. This could lead to the exposure of sensitive customer data or the corruption of automated business processes relying on the AI.

Technical details

The `POST /api/v1/prediction/:id` endpoint is unauthenticated and fails to validate the `overrideConfig` object before spreading it into internal `flowConfig` and `flowData` objects. This lack of gating (missing `apiOverrideStatus` check) allows an attacker to perform a mass assignment attack. By injecting properties like `chatId` or `chatHistory`, an attacker can access the memory of other sessions or perform prompt injection. Additionally, attackers can inject arbitrary values into `$flow.*` template variables, which may lead to further exploitation if those variables are used in sensitive node configurations like database queries or API calls. The issue is fixed in version 3.1.3.

Affected products

• FlowiseAI Flowise <= 3.1.2

Timeline

• 2026-07-29: advisory: GitHub Advisory published
• 2026-08-04: disclosed: CVE-2026-69258 assigned

References

• https://api.github.com/users/Aviral2642
• https://github.com/Aviral2642
• https://api.github.com/users/Aviral2642/gists%7B/gist_id%7D
• https://api.github.com/users/Aviral2642/repos
• https://avatars.githubusercontent.com/u/26358686?v=4
• https://api.github.com/users/Aviral2642/events%7B/privacy%7D