AI Threat AlertCVE-2026-91937: Flowise: NoSQL injection exposes other users' chat history
HIGHPoC AVAILABLEFlowise before 3.1.4 does not sanitize the overrideConfig.sessionId parameter in its MongoDBMemory node, so an unauthenticated attacker can send MongoDB operator objects through the prediction API and read chat history belonging to other users. Exploitation is trivial (network, low complexity, no privileges, CVSS 7.5), but the risk is confidentiality only, and the signals for mass exploitation are modest: EPSS is 0.0047 (top 61%), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC rates it TRACK. The exposure matters most for internet-facing Flowise deployments that use MongoDB-backed memory with a shared collection, because chat histories often contain PII, credentials, internal documents and business context pasted by users. Upgrade to Flowise 3.1.4 or later now, and review whether any exposed chatflows use MongoDBMemory.
What is the risk?
Medium-to-high for exposed deployments, moderate overall. Exploitability is high (unauthenticated, network, low complexity) and impact is high on confidentiality only (C:H/I:N/A:N). Real-world likelihood is tempered by EPSS 0.0047, no KEV listing, no public exploit or scanner template, and SSVC TRACK. The condition is also narrow: it needs a chatflow using the MongoDBMemory node with a shared collection, and a prediction endpoint reachable by the attacker. Risk rises for multi-tenant or customer-facing chatbots where histories from different users sit in one collection.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Flowise | npm | — | No patch |
Do you use Flowise? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade Flowise to 3.1.4 or later (see GHSA-wpvf-4vfx-rgxm). 2) Until patched, remove or disable MongoDBMemory nodes in internet-facing chatflows, or switch to a memory backend that is not affected. 3) Restrict access to the prediction API with authentication (API keys), a reverse proxy allowlist or network segmentation, and do not expose Flowise directly to the internet. 4) Block or reject prediction requests where overrideConfig.sessionId is an object instead of a string, using WAF or gateway rules. 5) Isolate tenants by using separate collections or databases per tenant. 6) Detection: review API and MongoDB logs for sessionId values containing operator keys such as $ne, $gt, $regex or $where, and for unusually large chat history reads. 7) If exposure is suspected, treat stored conversations as compromised, rotate any secrets that appeared in chats, and assess breach-notification obligations.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-91937?
Flowise before 3.1.4 does not sanitize the overrideConfig.sessionId parameter in its MongoDBMemory node, so an unauthenticated attacker can send MongoDB operator objects through the prediction API and read chat history belonging to other users. Exploitation is trivial (network, low complexity, no privileges, CVSS 7.5), but the risk is confidentiality only, and the signals for mass exploitation are modest: EPSS is 0.0047 (top 61%), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC rates it TRACK. The exposure matters most for internet-facing Flowise deployments that use MongoDB-backed memory with a shared collection, because chat histories often contain PII, credentials, internal documents and business context pasted by users. Upgrade to Flowise 3.1.4 or later now, and review whether any exposed chatflows use MongoDBMemory.
Is CVE-2026-91937 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2026-91937, increasing the risk of exploitation.
How to fix CVE-2026-91937?
1) Upgrade Flowise to 3.1.4 or later (see GHSA-wpvf-4vfx-rgxm). 2) Until patched, remove or disable MongoDBMemory nodes in internet-facing chatflows, or switch to a memory backend that is not affected. 3) Restrict access to the prediction API with authentication (API keys), a reverse proxy allowlist or network segmentation, and do not expose Flowise directly to the internet. 4) Block or reject prediction requests where overrideConfig.sessionId is an object instead of a string, using WAF or gateway rules. 5) Isolate tenants by using separate collections or databases per tenant. 6) Detection: review API and MongoDB logs for sessionId values containing operator keys such as $ne, $gt, $regex or $where, and for unusually large chat history reads. 7) If exposure is suspected, treat stored conversations as compromised, rotate any secrets that appeared in chats, and assess breach-notification obligations.
What systems are affected by CVE-2026-91937?
This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, LLM chatbot platforms, Conversational memory stores, Low-code LLM workflow builders.
What is the CVSS score for CVE-2026-91937?
CVE-2026-91937 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.47%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0036Data from Information RepositoriesAML.T0040AI Model Inference API AccessAML.T0049Exploit Public-Facing ApplicationAML.T0085Data from AI ServicesCompliance Controls Affected
What are the technical details?
Original Advisory
Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the shared collection.
Exploitation Scenario
An attacker finds a public Flowise instance running a customer-support chatbot with MongoDBMemory. They send a prediction API request with overrideConfig.sessionId set to a MongoDB operator object such as {"$ne": "x"} instead of a string. The unsanitized value goes into the MongoDB query, which returns chat history records for every session in the shared collection, and the history is fed back to the attacker in the model's context or response. By repeating the request with regex or range operators, the attacker enumerates and harvests other customers' conversations, extracting PII, internal data and any credentials users pasted into the chat.
Weaknesses (CWE)
CWE-943Improper Neutralization of Special Elements in Data Query LogicPrimaryCWE-943Improper Neutralization of Special Elements in Data Query LogicCWE-943 — Improper Neutralization of Special Elements in Data Query Logic: The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2025-7133810.0Flowise: unauthenticated file write enables RCE
Same package: flowiseCVE-2025-5952810.0Flowise: Unauthenticated RCE via MCP config injection
Same package: flowiseCVE-2025-619139.9Flowise: path traversal in file tools leads to RCE
Same package: flowiseCVE-2026-409339.9Flowise: RCE via MCP stdio command injection
Same package: flowiseCVE-2026-464429.9Flowise: sandbox escape enables authenticated RCE
Same package: flowise