CVE-2026-90535: Flowiseai Flowise DOS Vulnerability

CVE-2026-90535 Overview

CVE-2026-90535 is an unauthenticated denial of service vulnerability affecting Flowise versions before 3.1.4. The flaw resides in the /api/v1/text-to-speech/abort endpoint, which accepts a user-supplied chatflowId and chatId without verifying ownership. Attackers can terminate active chatflow predictions belonging to any user by submitting crafted requests referencing known chatflow and chat identifiers. The vulnerability is tracked as a missing authorization weakness [CWE-862] and enables targeted service disruption against Flowise deployments hosting AI orchestration workloads.

Critical Impact
Remote unauthenticated attackers can abort in-progress chatflow predictions for any user, causing targeted denial of service against Flowise-hosted AI workloads.

Affected Products

FlowiseAI Flowise versions prior to 3.1.4
Deployments exposing the /api/v1/text-to-speech/abort endpoint to untrusted networks
Self-hosted Flowise instances used for AI chatflow orchestration

Discovery Timeline

2026-09-12 - CVE-2026-90535 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90535

Vulnerability Analysis

Flowise exposes a REST endpoint at /api/v1/text-to-speech/abort that cancels active text-to-speech generation associated with a chatflow prediction. The endpoint accepts chatflowId and chatId values directly from the request body and uses them to terminate the corresponding server-side operation. The handler does not authenticate the caller or verify that the caller owns the referenced chat session. Any network-reachable actor can therefore issue abort requests targeting chatflow predictions in flight. The result is targeted disruption of AI inference workflows without any credential or session material.

Root Cause

The root cause is a missing authorization check on a state-changing endpoint, categorized under [CWE-862]. Flowise treats the abort operation as a lightweight lifecycle control and does not enforce the ownership model applied to other chatflow operations. Because the endpoint neither requires authentication nor validates that the supplied identifiers belong to the requester, identifier possession alone is sufficient to trigger the action. Chatflow and chat identifiers are frequently exposed through logs, referrers, shared links, or predictable enumeration, lowering the practical barrier to abuse.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker sends HTTP POST requests to /api/v1/text-to-speech/abort containing a valid chatflowId and chatId pair. Each accepted request terminates the associated prediction on the server. Repeated or scripted requests can systematically cancel active jobs, degrading availability for legitimate users. Confidentiality and integrity are not impacted; the flaw affects availability only, consistent with the reported denial of service scope. See the VulnCheck Advisory for Flowise and the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-90535

Indicators of Compromise

Unexpected HTTP POST traffic to /api/v1/text-to-speech/abort from unauthenticated or anonymous sources
Repeated abort requests iterating across different chatflowId or chatId values within a short time window
User reports of prematurely terminated chatflow predictions without corresponding client-side cancellations

Detection Strategies

Instrument the Flowise application layer to log every call to the abort endpoint with source IP, authentication state, and supplied identifiers
Alert on abort requests that lack a valid session cookie or bearer token when placed behind a reverse proxy
Correlate abort events with the identity of the chat session owner to surface cross-account termination attempts

Monitoring Recommendations

Forward Flowise access logs and reverse proxy logs to a centralized analytics pipeline for rate and pattern analysis
Baseline normal abort volume per tenant and trigger alerts when volume deviates significantly
Monitor for scanning behavior against /api/v1/text-to-speech/* routes originating from external networks

How to Mitigate CVE-2026-90535

Immediate Actions Required

Upgrade Flowise to version 3.1.4 or later, which introduces authorization checks on the abort endpoint
Restrict network exposure of Flowise management APIs to trusted networks or authenticated users only
Audit recent access logs for anomalous requests to /api/v1/text-to-speech/abort

Patch Information

FlowiseAI resolved the issue in Flowise 3.1.4. The fix adds ownership verification so that abort requests are honored only when the caller is authorized for the referenced chatflowId and chatId. Refer to the GitHub Security Advisory GHSA-xhxx-56g3-mx2r for release notes and upgrade guidance.

Workarounds

Place Flowise behind an authenticating reverse proxy that rejects unauthenticated requests to /api/v1/text-to-speech/abort
Apply web application firewall rules to block anonymous POSTs to the abort endpoint until the upgrade is deployed
Segment Flowise instances on internal networks and disallow direct internet exposure of the API surface

bash

# Example NGINX snippet restricting the abort endpoint to authenticated sessions
location = /api/v1/text-to-speech/abort {
    auth_request /_auth;
    proxy_pass http://flowise_upstream;
}