CVE-2026-69258

Flowise, an open-source drag-and-drop builder for LLM workflows, fails to validate attacker-supplied configuration on the unauthenticated POST /api/v1/prediction/:id endpoint in versions prior to 3.1.3. The endpoint accepts an overrideConfig object and spreads it unconditionally into internal flowConfig and flowData objects (in packages/server/src/utils/buildChatflow.ts and packages/server/src/utils/index.ts) without checking the apiOverrideStatus flag, so unauthenticated attackers can inject arbitrary properties into the execution context of any public chatflow. This lets an attacker overwrite values such as chatId, sessionId, and chatHistory and control values resolved through $flow.* template variables consumed by flow nodes, enabling manipulation of flow behavior and potential access to or poisoning of other sessions' conversation data. Anyone self-hosting Flowise before 3.1.3 with publicly reachable chatflows is affected; the flaw is fixed in version 3.1.3. A vendor security advisory with technical details is public, but EPSS is low (0.5% in 30 days) and no in-the-wild exploitation is known.

What to do: Upgrade Flowise to version 3.1.3 or later, where the apiOverrideStatus check is enforced. Until patched, avoid exposing the /api/v1/prediction/:id endpoint or public chatflows to untrusted networks and place deployments behind authentication or a reverse proxy with access controls. Review server logs for POST requests to /api/v1/prediction containing unexpected overrideConfig fields, and inspect chatHistory/sessionId data for signs of cross-session tampering.