CVE-2026-69258: Flowise Auth Bypass Vulnerability

CVE-2026-69258 Overview

CVE-2026-69258 is a broken access control vulnerability in Flowise, a drag-and-drop interface for building large language model (LLM) flows. Versions prior to 3.1.3 expose an unauthenticated POST /api/v1/prediction/:id endpoint that accepts an overrideConfig object. The server spreads that object into internal flowConfig and flowData structures without checking apiOverrideStatus. Unauthenticated attackers can inject arbitrary properties into any public chatflow execution context. Injected values overwrite chatId, sessionId, and chatHistory, and control variables resolved through $flow.* templates consumed by flow nodes. The issue is fixed in Flowise 3.1.3 and tracked as [CWE-639].

Critical Impact
Unauthenticated attackers can manipulate chatflow execution context, hijack sessions, and control prompt inputs across any public Flowise chatflow.

Affected Products

Flowise versions prior to 3.1.3
packages/server/src/utils/buildChatflow.ts
packages/server/src/utils/index.ts

Discovery Timeline

2026-08-04 - CVE-2026-69258 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-69258

Vulnerability Analysis

Flowise exposes a prediction endpoint that public chatflows use to receive user input. The server accepts an overrideConfig object in the request body and uses JavaScript spread syntax to merge it into internal execution context objects. The merge happens unconditionally, without evaluating the chatflow's apiOverrideStatus gate that is intended to restrict which properties can be overridden.

The result is a mass assignment weakness. Any request property named in overrideConfig is written into flowConfig or flowData, including sensitive runtime values. Attackers can overwrite identifiers used for authorization and correlation, or inject values that are later interpolated into LLM prompts through $flow.* template variables.

Root Cause

The root cause is an ungated object spread of user-controlled input into trusted server state. The code in buildChatflow.ts spread incomingInput.overrideConfig into the runtime object alongside chatId, sessionId, chatHistory, and apiMessageId. A parallel pattern existed in buildAgentflow.ts. Because the endpoint is unauthenticated for public chatflows, no identity or entitlement check bounds the operation, matching the [CWE-639] Authorization Bypass Through User-Controlled Key pattern.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted POST request to /api/v1/prediction/:id targeting any public chatflow. The request body includes an overrideConfig object with attacker-controlled keys such as sessionId, chatHistory, or arbitrary variables consumed by downstream nodes. The following patch removed the vulnerable spread operations.

typescript

// packages/server/src/utils/buildChatflow.ts
        chatId,
        sessionId,
        chatHistory,
-        apiMessageId,
-        ...incomingInput.overrideConfig
+        apiMessageId
    }

    logger.debug(`[server]: [${orgId}]: Start building flow ${chatflowid}`)

typescript

// packages/server/src/utils/buildAgentflow.ts
            apiMessageId,
            chatHistory,
            runtimeChatHistoryLength: Math.max(0, runtimeChatHistory.length - 1),
-            state: updatedState,
-            ...overrideConfig
+            state: updatedState
        }

Source: FlowiseAI/Flowise commit 23b997e

Detection Methods for CVE-2026-69258

Indicators of Compromise

HTTP POST requests to /api/v1/prediction/:id containing an overrideConfig JSON object with reserved keys such as chatId, sessionId, chatHistory, or apiMessageId.
Chatflow logs showing session or chat identifiers that do not correspond to any legitimate client interaction.
Unexpected $flow.* template variable values appearing in prompt traces or downstream tool invocations.

Detection Strategies

Inspect application and reverse-proxy logs for prediction requests whose bodies contain an overrideConfig key when the chatflow is not intended to accept overrides.
Compare apiOverrideStatus configuration of each chatflow against observed override activity to identify unauthorized property assignment.
Correlate anomalous chat history contents with the source IP submitting the request to identify probing behavior.

Monitoring Recommendations

Enable verbose Flowise server logging and forward request bodies for /api/v1/prediction/* to a central log store for review.
Monitor for spikes in unauthenticated requests to public chatflow endpoints, particularly from a single source.
Alert on any prompt content injected through $flow.* variables that resembles prompt-injection or data-exfiltration payloads.

How to Mitigate CVE-2026-69258

Immediate Actions Required

Upgrade Flowise to version 3.1.3 or later, which removes the ungated overrideConfig spread in buildChatflow.ts and buildAgentflow.ts.
Audit all public chatflows and disable any that are not required for external access.
Rotate any secrets, API keys, or session tokens that may have been referenced by affected chatflows.

Patch Information

The fix ships in Flowise 3.1.3. See the GitHub Release 3.1.3, pull request #6279, and GHSA-6vh2-wg4h-4vwj advisory for full technical detail.

Workarounds

Restrict network access to the Flowise /api/v1/prediction/* endpoints behind an authenticated reverse proxy until the patch is applied.
Set apiOverrideStatus to disabled on all chatflows, and remove public exposure for any chatflow that must accept overrideConfig values.
Deploy a web application firewall rule that strips or rejects requests containing an overrideConfig field to prediction endpoints.

bash

# Upgrade Flowise to the patched release
npm install -g flowise@3.1.3

# Or, if running via Docker, pull the fixed image tag
docker pull flowiseai/flowise:3.1.3
docker stop flowise && docker rm flowise
docker run -d --name flowise -p 3000:3000 flowiseai/flowise:3.1.3