Loading story…
A high-severity vulnerability in Flowise, tracked as CVE-2026-69258, allows unauthenticated attackers to tamper with the execution context of public chatflows through the POST /api/v1/prediction/:id endpoint. In affected versions before 3.1.3, the application accepted an overrideConfig object and merged it into internal flowConfig and flowData structures without enforcing apiOverrideStatus, enabling attackers to overwrite values such as sessionId, chatId, and chatHistory and bypass session isolation.
The flaw can let attackers access, pollute, or hijack other users’ conversations and inject arbitrary properties into the $flow.* namespace used by flow nodes, including variables that may influence SQL queries, webhooks, and API integrations. The issue is rated CVSS 8.8 and mapped to CWE-639 and CWE-915; while it does not directly provide operating-system-level remote code execution, it can break logical security boundaries and corrupt routing, prompt history, and downstream workflow behavior. Flowise patched the issue in version 3.1.3, and users are advised to upgrade.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE entry states that security-advisories@github.com received the new CVE report for CVE-2026-69258 on August 4, 2026.
The Medium post states the issue was reported to FlowiseAI through a GitHub Security Advisory in March 2026. Flowise acknowledged the report within three days and confirmed the severity as High.
Flowise addressed the unauthenticated overrideConfig property injection and authorization bypass issue in version 3.1.3. The fix removed the vulnerable spread of overrideConfig into internal flow execution objects, with references pointing to commit 23b997ee5ef9e269b628bad0f56f1ecb86bd2fca and related remediation materials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourcecvefeed.io
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Flowise disclosed and fixed a cluster of high-severity vulnerabilities in versions prior to **3.1.0**, including multiple paths to remote code execution. The most serious issues affect the platform's CSV and Airtable agent components, where unsanitized user input or LLM-generated Python code could be evaluated without proper sandboxing. Advisories for **`CVE-2026-41137`**, **`CVE-2026-41264`**, **`CVE-2026-41138`**, and **`CVE-2026-41265`** describe authenticated and unauthenticated attack paths that let attackers inject malicious payloads through chatflows or agent inputs and execute code on the Flowise server, with potential impact to confidentiality, integrity, and availability. Flowise **3.1.0** also addresses non-RCE flaws that could expose multi-tenant environments and consume third-party service credits. **`CVE-2026-41279`** affects the unauthenticated text-to-speech endpoint at **`POST /api/v1/text-to-speech/generate`**, which could accept an arbitrary **`credentialId`** and use decrypted stored credentials such as OpenAI or ElevenLabs API keys to generate speech, enabling API credit abuse. In **Flowise Cloud**, **`CVE-2026-41267`** allows improper mass assignment during account registration, letting unauthenticated attackers inject server-managed fields and manipulate organization associations, ownership metadata, timestamps, and role mappings across tenants. Organizations running Flowise or Flowise Cloud should upgrade to **3.1.0** and review exposed chatflows, stored credentials, and tenant registration controls.
Jun 29, 2026
A critical vulnerability tracked as **CVE-2026-56271** allows remote attackers to bypass authentication in **Flowise** by forging valid JWTs and impersonating arbitrary users, including administrators. The flaw affects versions before **3.1.0**, including **3.0.13** and earlier, and stems from weak hardcoded default JWT secrets plus default audience and issuer values in the enterprise passport authentication middleware. When the relevant JWT environment variables are not explicitly configured, Flowise falls back to publicly known defaults, effectively embedding insecure default credentials into the authentication path. The issue is rated **CVSS v3.1 9.8** and **CVSS v4.0 9.3** as remotely exploitable, and remediation guidance calls for upgrading to **Flowise 3.1.0 or later** and setting strong, unique JWT secrets along with custom audience and issuer values.
Jul 18, 2026
A critical remote code execution vulnerability, tracked as CVE-2025-61913, has been identified in Flowise, a drag-and-drop user interface for building customized large language model flows. The flaw exists in versions prior to 3.0.8 and is caused by insufficient restrictions in the WriteFileTool and ReadFileTool components, which fail to properly validate file path access. This oversight allows authenticated attackers to read and write arbitrary files to any location on the file system, significantly increasing the risk of remote code execution. The vulnerability has been assigned a CVSS score of 10.0, indicating its maximum severity and potential for exploitation. According to security advisories, the issue can be exploited remotely, making it a high-priority concern for organizations using affected versions of Flowise. The vulnerability was publicly disclosed on October 8, 2025, and a security update was released in version 3.0.8 to address the issue. Attackers leveraging this flaw could gain unauthorized access to sensitive files, modify system configurations, or deploy malicious payloads, potentially leading to full system compromise. The vulnerability affects all installations of Flowise prior to the patched version, though the exact list of affected products and vendors has not been fully enumerated. Security researchers emphasize the critical nature of the flaw due to the ease of exploitation and the broad impact on confidentiality, integrity, and availability. Organizations are strongly advised to upgrade to Flowise version 3.0.8 or later to mitigate the risk. The vulnerability was reported through GitHub security advisories, highlighting the importance of monitoring open-source project disclosures. No evidence of active exploitation in the wild has been reported as of the disclosure date, but the public availability of technical details increases the urgency for remediation. The flaw underscores the risks associated with insufficient input validation in file handling components of web applications. Security teams should review their deployment of Flowise and apply the necessary patches without delay. In addition to patching, organizations should audit access logs for signs of suspicious file operations that could indicate attempted exploitation. The incident serves as a reminder of the critical need for secure coding practices and regular vulnerability assessments in software development.
Jun 29, 2026