CVE-2026-69258: Flowise unauth overrideConfig injects

Q: Is CVE-2026-69258 actively exploited?

No confirmed active exploitation of CVE-2026-69258 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-69258?

1) Upgrade to Flowise 3.1.3 or later immediately — this is the definitive fix. 2) Until patched, audit every public chatflow's apiOverrideStatus setting and disable config overrides on any chatflow that doesn't explicitly need them. 3) Where public prediction endpoints must remain open, put them behind a reverse proxy/WAF rule that strips or flags overrideConfig fields containing chatId, sessionId, chatHistory, or unexpected keys. 4) Review flow node definitions for reliance on $flow.* variables in security-sensitive logic (auth checks, tool invocation gating, content filters) and treat those as attacker-influenceable until patched. 5) Detection: alert on prediction API requests with overrideConfig payloads containing session/history keys, and monitor for chatHistory values that don't match server-recorded conversation state.

Q: What systems are affected by CVE-2026-69258?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM app builders / low-code AI flows, conversational session management.

Q: What is the CVSS score for CVE-2026-69258?

No CVSS score has been assigned yet.

CISO Take

Flowise's public prediction API let anyone, without authentication, smuggle arbitrary key-value pairs through an overrideConfig object straight into the internal flow execution context, because the server never checked whether config overrides were actually enabled for that chatflow. That means an outsider can rewrite chatId, sessionId, and chatHistory on any publicly exposed chatflow, and can seed values that flow nodes later resolve via $flow.* template variables — effectively steering conversation state and downstream node logic without ever logging in. The blast radius is capped by real-world adoption rather than package graph depth (0 recorded npm dependents, but Flowise is a widely self-hosted low-code agent builder, so exposure tracks how many organizations run public-facing chatflows); EPSS sits at 0.00383 (top 68th percentile, still a low absolute probability), it isn't in CISA KEV, and no public exploit or Nuclei template exists yet, so this reads as a real but not yet weaponized bug. Patch to Flowise 3.1.3 now; until then, treat any public chatflow as untrusted input, verify apiOverrideStatus is enforced (it wasn't pre-3.1.3), and watch prediction API logs for overrideConfig payloads carrying unexpected keys like chatId/sessionId/chatHistory or unfamiliar $flow.* references.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

High severity per the advisory but tempered exploitation likelihood: the flaw requires no authentication and no user interaction (classic mass-assignment / authorization-bypass-through-user-controlled-key pattern, CWE-639/CWE-915), which makes it trivially reachable by any internet scanner hitting a public Flowise instance. However, EPSS (0.00383, top 68th percentile) is low in absolute terms, there's no CISA KEV listing, no public PoC, and no Nuclei template — CISA's own SSVC decision is TRACK_STAR (monitor, not urgent action). The real risk driver is deployment posture: Flowise chatflows are frequently exposed publicly by design (embeddable chat widgets), so the population of vulnerable public endpoints could be meaningful even though this specific npm package shows 0 tracked dependents. Impact is state manipulation rather than direct code execution or data exfiltration, but downstream consequences depend entirely on what a given chatflow's nodes do with $flow.* variables — some deployments could chain this into prompt injection, guardrail bypass, or cross-session contamination.

How does the attack unfold?

Discovery

Attacker identifies a public Flowise chatflow exposing the unauthenticated POST /api/v1/prediction/:id endpoint.

AML.T0049

Config injection

Attacker sends a crafted overrideConfig object; the server spreads it unchecked into flowConfig and flowData, bypassing the apiOverrideStatus gate.

AML.T0081

Context poisoning

Injected values overwrite chatId, sessionId, and chatHistory, and populate $flow.* variables consumed by flow nodes.

AML.T0080.001

Impact

Downstream flow logic acts on the poisoned session/context data, enabling session hijacking, history poisoning, or manipulated agent behavior.

AML.T0051.001

Discovery

Attacker identifies a public Flowise chatflow exposing the unauthenticated POST /api/v1/prediction/:id endpoint.

AML.T0049

Config injection

Attacker sends a crafted overrideConfig object; the server spreads it unchecked into flowConfig and flowData, bypassing the apiOverrideStatus gate.

AML.T0081

Context poisoning

Injected values overwrite chatId, sessionId, and chatHistory, and populate $flow.* variables consumed by flow nodes.

AML.T0080.001

Impact

Downstream flow logic acts on the poisoned session/context data, enabling session hijacking, history poisoning, or manipulated agent behavior.

AML.T0051.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	<= 3.1.2	`3.1.3`

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.5%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Upgrade to Flowise 3.1.3 or later immediately — this is the definitive fix. 2) Until patched, audit every public chatflow's apiOverrideStatus setting and disable config overrides on any chatflow that doesn't explicitly need them. 3) Where public prediction endpoints must remain open, put them behind a reverse proxy/WAF rule that strips or flags overrideConfig fields containing chatId, sessionId, chatHistory, or unexpected keys. 4) Review flow node definitions for reliance on $flow.* variables in security-sensitive logic (auth checks, tool invocation gating, content filters) and treat those as attacker-influenceable until patched. 5) Detection: alert on prediction API requests with overrideConfig payloads containing session/history keys, and monitor for chatHistory values that don't match server-recorded conversation state.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Prompt Injection Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0051.001 - Indirect AML.T0080.001 - Thread AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

GOVERN 1.5 - Ongoing monitoring and periodic review of risk management process

OWASP LLM Top 10

LLM01 - Prompt Injection

Frequently Asked Questions

What is CVE-2026-69258?

Flowise's public prediction API let anyone, without authentication, smuggle arbitrary key-value pairs through an overrideConfig object straight into the internal flow execution context, because the server never checked whether config overrides were actually enabled for that chatflow. That means an outsider can rewrite chatId, sessionId, and chatHistory on any publicly exposed chatflow, and can seed values that flow nodes later resolve via $flow.* template variables — effectively steering conversation state and downstream node logic without ever logging in. The blast radius is capped by real-world adoption rather than package graph depth (0 recorded npm dependents, but Flowise is a widely self-hosted low-code agent builder, so exposure tracks how many organizations run public-facing chatflows); EPSS sits at 0.00383 (top 68th percentile, still a low absolute probability), it isn't in CISA KEV, and no public exploit or Nuclei template exists yet, so this reads as a real but not yet weaponized bug. Patch to Flowise 3.1.3 now; until then, treat any public chatflow as untrusted input, verify apiOverrideStatus is enforced (it wasn't pre-3.1.3), and watch prediction API logs for overrideConfig payloads carrying unexpected keys like chatId/sessionId/chatHistory or unfamiliar $flow.* references.

Is CVE-2026-69258 actively exploited?

No confirmed active exploitation of CVE-2026-69258 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-69258?

1) Upgrade to Flowise 3.1.3 or later immediately — this is the definitive fix. 2) Until patched, audit every public chatflow's apiOverrideStatus setting and disable config overrides on any chatflow that doesn't explicitly need them. 3) Where public prediction endpoints must remain open, put them behind a reverse proxy/WAF rule that strips or flags overrideConfig fields containing chatId, sessionId, chatHistory, or unexpected keys. 4) Review flow node definitions for reliance on $flow.* variables in security-sensitive logic (auth checks, tool invocation gating, content filters) and treat those as attacker-influenceable until patched. 5) Detection: alert on prediction API requests with overrideConfig payloads containing session/history keys, and monitor for chatHistory values that don't match server-recorded conversation state.

What systems are affected by CVE-2026-69258?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM app builders / low-code AI flows, conversational session management.

What is the CVSS score for CVE-2026-69258?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM app builders / low-code AI flowsconversational session management

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0051.001 Indirect

AML.T0080.001 Thread

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: GOVERN 1.5

OWASP LLM Top 10: LLM01

What are the technical details?

Original Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in packages/server/src/utils/buildChatflow.ts and packages/server/src/utils/index.ts without checking apiOverrideStatus. This allowed unauthenticated attackers to inject arbitrary properties into the flow execution context of any public chatflow, overwrite values such as chatId, sessionId, and chatHistory, and control values resolved through $flow.* template variables consumed by flow nodes. This issue is fixed in version 3.1.3.

Exploitation Scenario

An attacker enumerates public Flowise chatflow endpoints (many are intentionally exposed for embeddable chat widgets) and identifies one accepting POST /api/v1/prediction/:id without authentication. Without needing to authenticate or interact with a real user, they send a crafted request containing an overrideConfig object that sets chatHistory to a fabricated prior conversation implying the assistant already agreed to bypass a safety instruction, and sets sessionId to collide with or hijack another active session. Because apiOverrideStatus was never checked, the server spreads these attacker-controlled values directly into flowConfig/flowData, and any node resolving $flow.* variables downstream (e.g., a prompt template referencing $flow.chatHistory or a conditional gate referencing $flow.sessionId) acts on the poisoned data — resulting in guardrail bypass, cross-session data bleed, or manipulated agent behavior on subsequent turns.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes Primary CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes Primary CWE-639 Authorization Bypass Through User-Controlled Key CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.