CVE-2026-91937
Received Received - Intake

Flowise Session ID Injection Leading to Unauthorized MongoDB Data Access

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the shared collection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91937
EUVD
EUVD-2026-78795

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flowiseai flowise to 3.1.4 (exc)
flowise flowise to 3.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Flowise before version 3.1.4 has a NoSQL injection vulnerability due to improper sanitization of the overrideConfig.sessionId parameter in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can inject MongoDB operator objects via the prediction API to read chat history records belonging to other users from the shared collection.

Detection Guidance

To detect this vulnerability, monitor for unusual MongoDB queries containing operator objects like {"$ne": null} in the overrideConfig.sessionId parameter. Check Flowise logs for requests to /api/v1/prediction/ with unexpected session ID formats. Use network traffic analysis to identify unauthenticated prediction API calls with complex session ID objects.

Impact Analysis

This vulnerability allows unauthenticated attackers to access chat history records of other users, potentially exposing sensitive data such as API keys or passwords. The impact is higher for public chatflows and private chatflows with shared API keys.

Mitigation Strategies

Immediately upgrade Flowise to version 3.1.4 or later. If upgrading is not possible, implement input validation to ensure sessionId is a string and not an object. Restrict access to the /api/v1/prediction/ endpoint by requiring authentication. Monitor for suspicious queries or data access patterns in MongoDB logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91937. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart