Executive brief
Flowise is an open-source AI workflow platform that stores chat conversations in MongoDB. The MongoDBMemory component fails to validate user-supplied session identifiers, allowing unauthenticated attackers to inject MongoDB operators and retrieve chat history from any user in the shared database—potentially exposing API keys, passwords, and other sensitive information shared with the AI agent.
Technical details
The vulnerability is a NoSQL injection in the MongoDBMemory node caused by two weaknesses: (1) the overrideConfig.sessionId parameter is typed as Record<string, any> without constraints, allowing JSON deserialization of operator objects; (2) the sessionId is never type-coerced to a string before being passed to MongoDB's findOne() query. An unauthenticated attacker can POST to /api/v1/prediction/ (which is whitelisted and requires no authentication) with a JSON body containing {"overrideConfig":{"sessionId":{"$ne":null}}} to cause the MongoDB driver to interpret the operator and return arbitrary documents from the collection. This bypasses session isolation entirely and grants read access to other users' chat histories. The issue affects versions before 3.1.4 and is fixed in 3.1.4 and later.
Affected products
- FlowiseAI Flowise before 3.1.4
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory (GHSA-wpvf-4vfx-rgxm) published
- 2026-09-15: advisory: NVD published CVE-2026-91937
- 2026-09-15: patched: Flowise 3.1.4 released with fix