CVE-2026-69258

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description An unauthenticated endpoint allows attackers to inject arbitrary properties into the flow execution context of any public chatflow. This occurs because the overrideConfig object provided in requests is unconditionally merged into internal flowConfig and flowData objects without verifying the apiOverrideStatus setting. This flaw enables session hijacking, cross-session data pollution, and chat history manipulation. Specifically, attackers can overwrite critical variables such as chatId, sessionId, and chatHistory, or control values resolved through $flow.* template variables used by flow nodes.

Technical details include:

Recommendations Update Flowise to version 3.1.3 or later. As a temporary mitigation, restrict access to the POST /api/v1/prediction/:id endpoint to trusted networks only.