{"uuid": "72368b0b-28d0-49a3-b139-8fa5f5024c87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69258", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3muep7yrslk25", "content": "The Spread Operator Is an Allowlist With Nothing In It: CVE-2026-69258 in Flowise\n\nCVE-2026-69258: two ungated spread operators let an unauthenticated caller write into the flow execution context of any public Flowise chatflow.\n#hackernews #news", "creation_timestamp": "2026-08-31T10:30:53.504218Z"}