Unauthenticated Input Vulnerability in Flowise Drag & Drop Interface
CVE-2026-69258
8.8HIGH
What is CVE-2026-69258?
Flowise, a drag & drop user interface designed for customizing large language models, suffers from an input validation issue. Prior to version 3.1.3, the /api/v1/prediction/:id endpoint could be exploited by unauthenticated attackers. They could inject arbitrary properties into the internal flow execution context, potentially compromising values such as chatId, sessionId, and chatHistory. This vulnerability allows attackers to manipulate template variable resolutions within public chatflows, posing a significant risk to the integrity and security of the Flowise environment. The issue has been addressed in version 3.1.3, which is recommended for all users.
Affected Version(s)
Flowise < 3.1.3