CVE-2026-69258 is a critical (CVSS 9.1) flaw in Flowise before 3.1.3. The unauthenticated prediction endpoint copied an overrideConfig object into internal flow objects without checking the apiOverrideStatus setting. That lets callers overwrite values such as chat and session IDs. Upgrade to 3.1.3.
What's affected
- Product: Flowise, the drag and drop builder for large language model flows (FlowiseAI).
- Affected versions: before 3.1.3.
- Fixed version: 3.1.3. The Flowise GitHub repository page shows that it was archived on 13 August 2026, so check where maintained releases come from before you plan the upgrade.
- What the advisory says: the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and spread it into internal flow objects without checking apiOverrideStatus, allowing injection of arbitrary properties into the flow execution context of any public chatflow, including chatId, sessionId and chatHistory.
- Weaknesses: CWE-639 authorization bypass through user controlled key and CWE-915 improperly controlled modification of dynamically determined object attributes.
- Severity: CVSS 3.1 9.1, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
How to check if you're exposed
Check the installed Flowise version:
npm ls -g flowise
docker image ls | grep -i flowise
For a running instance, the version is shown in the application's settings or about page. Anything below 3.1.3 is in range. Then check which chatflows are reachable without authentication through the prediction endpoint, because that endpoint is the entry point for this CVE.
What to do now
- Find every Flowise instance, including test and demo servers.
- Upgrade to Flowise 3.1.3 or later.
- Check that Flowise is not reachable from the internet without authentication in front of it.
- Review chatflows and agent flows for nodes or settings you did not create.
- Rotate API keys and credentials stored in Flowise if the instance was exposed.
Why it matters
The pattern is mass assignment: the server takes a whole object from the request and merges it into its own internal state. Flowise has a setting that decides which values a caller may override, but this code path skipped it. A caller could therefore set internal fields, including the chat identifiers and history, and control values that flow nodes read through template variables.
Confidentiality and integrity are both rated high. Overwriting a session ID can point a request at another user's conversation, and overwriting chat history can steer what a model sees. The pull request that fixed it removed the ungated merge and says internal variables still resolve because they are explicit fields. The CISA KEV flag is false and no exploitation is reported.
Quick check
Does this need an account?
No. The endpoint is the public prediction endpoint, and the vector says no privileges.
What is mass assignment?
It is merging a full request object into internal state, so callers can set fields that should only be set by the server.
Sources
- GitHub security advisory GHSA-6vh2-wg4h-4vwj
- Fix pull request 6279
- Flowise release 3.1.3
- Gold record for CVE-2026-69258
Last reviewed: 19 October 2026.
