CVE-2026-91937: Flowise before 3.1.4 NoSQL Injection via sessionId

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-15 · updated 2026-09-23
Weakness: CWE-943

Description

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the shared collection.

Affected products

FlowiseAI Flowise: before 3.1.4 — fixed in 3.1.4

How to fix

Upgrade to a fixed version: FlowiseAI Flowise 3.1.4. Check the vendor advisory for mitigations.

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wpvf-4vfx-rgxm
https://www.vulncheck.com/advisories/flowise-before-3.1.4-nosql-injection-via-sessionid

Get alerted when CVE-2026-91937 or the next vulnerability affects your stack