https://vulnerability.circl.lu/sightings/feed 2026-08-04T20:03:48.013228+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/645c14e4-2261-4ec3-958d-be1ea5dffe0b/export 2026-08-04T20:03:48.036019+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "645c14e4-2261-4ec3-958d-be1ea5dffe0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69258", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/dc4vgbfsfr6zf", "content": "CVE-2026-69258 - Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API\nCVE ID : CVE-2026-69258\n \n Published : Aug. 4, 2026, 5:17 p.m. | 29\u00a0minutes ago\n \n Description : Flowise is a drag & drop user int...", "creation_timestamp": "2026-08-04T17:54:36.042410Z"} 2026-08-04T17:54:36.042410+00:00 https://vulnerability.circl.lu/sighting/e615d362-62fe-44d2-a929-35bba8f16d19/export 2026-08-04T20:03:48.038227+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "e615d362-62fe-44d2-a929-35bba8f16d19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69258", "type": "published-proof-of-concept", "source": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6vh2-wg4h-4vwj", "content": "", "creation_timestamp": "2026-08-04T16:35:03.636398Z"} 2026-08-04T16:35:03.636398+00:00 https://vulnerability.circl.lu/sighting/073fc14e-da75-43c8-90eb-0debcf4fd1d6/export 2026-08-04T20:03:48.039202+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "073fc14e-da75-43c8-90eb-0debcf4fd1d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69258", "type": "seen", "source": "https://gist.github.com/alon710/6149a4f7f7f2ae19b65c163d6f6db13a", "content": "# CVE-2026-69258: CVE-2026-69258: Unauthenticated Property Injection and Authorization Bypass in Flowise\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69258\n\n## Summary\nCVE-2026-69258 is a high-severity property injection and unauthenticated authorization bypass vulnerability in Flowise, a drag-and-drop orchestration interface for building customized LLM workflows. In affected versions prior to 3.1.3, the unauthenticated prediction API endpoint (`POST /api/v1/prediction/:id`) processed client-controlled parameters inside an `overrideConfig` payload without authorization checks. The backend unconditionally spread this object into internal context structures, enabling unauthenticated remote attackers to overwrite critical session values, pollute execution contexts, and bypass flow restrictions.\n\n## TL;DR\nAn unauthenticated property injection vulnerability in Flowise (< 3.1.3) allows remote attackers to overwrite critical workflow parameters, facilitating session hijacking and prompt injection.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-915 / CWE-639\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.8\n- **Vulnerability Class**: Property Injection / Authorization Bypass\n- **Exploit Status**: Proof-of-Concept Available\n- **Remediation**: Upgrade to v3.1.3 or higher\n\n## Affected Systems\n\n- Flowise deployments exposing unauthenticated prediction endpoints (< 3.1.3)\n- **Flowise**: < 3.1.3 (Fixed in: `3.1.3`)\n\n## Mitigation\n\n- Upgrade Flowise server instances to version 3.1.3 or higher immediately.\n- Deploy WAF rules to block JSON requests targeting prediction endpoints that contain 'overrideConfig' along with internal state keys.\n- Audit existing workflow schemas to identify and secure any reliance on user-supplied variables within administrative routing nodes.\n\n**Remediation Steps:**\n1. Determine current package version using 'npm list -g flowise' or checking the container version.\n2. Run 'npm install -g flowise@latest' or update the docker-compose image to 'flowiseai/flowise:3.1.3'.\n3. Restart the Flowise service to apply configuration changes.\n4. Verify that the prediction API endpoint now safely ignores unauthenticated parameters inside the overrideConfig parameter block.\n\n## References\n\n- [GitHub Security Advisory GHSA-6vh2-wg4h-4vwj](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6vh2-wg4h-4vwj)\n- [Flowise Pull Request #6279](https://github.com/FlowiseAI/Flowise/pull/6279)\n- [Flowise Security Fix Commit](https://github.com/FlowiseAI/Flowise/commit/23b997ee5ef9e269b628bad0f56f1ecb86bd2fca)\n- [Flowise v3.1.3 Release Notes](https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3)\n- [CVE Official Entry](https://www.cve.org/CVERecord?id=CVE-2026-69258)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69258) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T16:31:33.352278Z"} 2026-08-04T16:31:33.352278+00:00