CVE-2026-90535

Executive Summary

CVE-2026-90535 is an unauthenticated denial-of-service vulnerability in Flowise versions prior to 3.1.4. The /api/v1/text-to-speech/abort endpoint accepts attacker-supplied chatflowId and chatId parameters without verifying that the requester owns or is authorized for that chatflow session, allowing any unauthenticated party to terminate active predictions belonging to other users. The impact is targeted service disruption against multi-tenant or shared Flowise deployments, with no confidentiality or integrity loss but a high availability impact.

Technical Analysis

Flowise is a low-code / open-source framework for building LLM orchestration flows ("chatflows") and exposing them through chat and API interfaces. Text-to-speech (TTS) is one of the supported output modalities, and the platform exposes a control endpoint at /api/v1/text-to-speech/abort used to cancel an in-progress TTS/prediction operation.

The vulnerability class is Missing Authorization (CWE-862). According to the NVD description, the abort endpoint "accepts user-supplied chatflowId and chatId without ownership verification." This means:

• The endpoint is reachable without authentication (unauthenticated attack surface).
• Its handler resolves the active prediction/TTS session using only the client-provided chatflowId and chatId values.
• There is no check tying the authenticated principal (or session) to the chatflowId/chatId being aborted.

Because the identifiers are the only access-control gate, an attacker who can obtain or guess valid chatflowId/chatId pairs can issue abort requests that cancel other users' in-flight predictions. The result is a targeted, repeatable denial of service against specific chatflow sessions rather than a full platform crash.

The exact identifier format and entropy of chatflowId and chatId are not specified in the available data, so the practical difficulty of enumerating valid identifiers cannot be stated with certainty from the source material. No CVSS vector or score was published by NVD (CVSS: N/A), and no EPSS score has been assigned by FIRST.org.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is known for CVE-2026-90535; the attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker identifies internet-exposed Flowise instances (which are commonly deployed as internal chat/LLM gateways). Using Shodan-style discovery (http.title:"Flowise", http.html:"Flowise") or direct scanning, the attacker locates reachable /api/v1/... surfaces. No authentication is required to reach the abort endpoint.

2. Identifier acquisition. The attacker must obtain valid chatflowId and chatId values. Because the NVD description states the endpoint accepts these "with known chatflow and chat identifiers," the identifiers are the prerequisite. Depending on deployment, these may be obtained from published/embedded chat URLs, shared links, logs, or predictable naming — but the description does not state that the identifiers are easily enumerable, so this step is the primary constraint on exploitability.

3. Triggering the flaw class. With valid identifiers, the attacker sends a crafted request to /api/v1/text-to-speech/abort supplying the victim's chatflowId and chatId. The handler aborts the matching active prediction without verifying ownership — the missing-authorization condition described in CWE-862.

4. Post-exploitation impact. The victim's active prediction/TTS operation terminates. Repeated or automated submission of abort requests against a known session produces a sustained denial of service for that chatflow. There is no data exfiltration, code execution, or lateral movement implied by the description; impact is strictly availability-oriented and scoped to targeted sessions.

Impact Assessment

• Availability (High): Successful aborts terminate legitimate in-flight predictions, disrupting user workflows and dependent applications. Repeated abuse converts this into persistent DoS against a targeted chatflow.
• Confidentiality (None) / Integrity (None): The described mechanism only aborts sessions; no read or modification of data is described.
• Attack complexity: Low at the request layer (no auth, no special tooling depicted), but constrained by the need to know valid chatflowId/chatId. The NVD description references "known" identifiers, implying the attack depends on prior disclosure or discovery.
• Privileges required: None (unauthenticated).
• Blast radius: Any user of a shared multi-tenant Flowise instance whose chatflowId/chatId becomes known to an attacker. Single-tenant instances are less exposed unless identifiers leak.
• Business impact: Degraded reliability of LLM chat/TTS services, user-facing outages, and potential SLA violations for organizations embedding Flowise in production. No monetary, regulatory, or reputational impact beyond availability disruption.
• CVSS note: NVD published no score (CVSS: N/A). The vector shown in METADATA is an analyst-derived estimate consistent with an unauthenticated, network-reachable availability-only defect and is not an NVD-assigned value.

Detection Guidance

Sigma Rule

title: Flowise Unauthorized Text-to-Speech Abort Attempt (CVE-2026-90535)
id: 4f8c2b1e-9d3a-4a7c-bb21-flowise-abort-dos
status: experimental
description: Detects requests to the Flowise /api/v1/text-to-speech/abort endpoint that may be unauthorized DoS aborts on other users' chatflows.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90535
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-method: 'POST'
    cs-uri-stem|contains: '/api/v1/text-to-speech/abort'
  selection_no_auth:
    cs-uri-query|contains:
      - 'chatflowId='
      - 'chatId='
  condition: selection_uri
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate single-user abort requests from the chat UI
level: medium

YARA Rule

rule CVE_2026_90535_Flowise_Abort_DoS
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects generic scanner/probe activity referencing Flowise text-to-speech abort endpoint"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90535"
        date = "2026-01-01"

    strings:
        $ep = "/api/v1/text-to-speech/abort" ascii wide nocase
        $cf = "chatflowId" ascii wide nocase
        $ci = "chatId" ascii wide nocase

    condition:
        $ep and any of ($cf, $ci)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90535 Flowise Text-to-Speech Abort Endpoint Access"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/text-to-speech/abort"; nocase; http.uri; content:"chatflowId"; nocase; http.uri; content:"chatId"; nocase; classtype:attempted-dos; reference:cve,2026-90535; sid:202690535; rev:1;)

Elastic Detection

network where
  http.request.method == "POST" and
  stringContains(http.request.uri, "/api/v1/text-to-speech/abort") and
  stringContains(http.request.uri, "chatflowId") and
  stringContains(http.request.uri, "chatId")

Splunk SPL Query

index=web OR index=proxy
| eval uri = coalesce(uri_path, cs_uri_stem, url)
| eval qs  = coalesce(uri_query, cs_uri_query, query_string)
| where match(uri, "/api/v1/text-to-speech/abort")
| where (match(qs, "chatflowId") AND match(qs, "chatId"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(clientip) as client_ips by uri, qs
| where count > 5

Wazuh OSSEC Rule

<group name="web,flowise,cve_2026_90535,">
  <rule id="100535" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/v1/text-to-speech/abort</url>
    <description>CVE-2026-90535: Potential unauthorized Flowise text-to-speech abort request (DoS).</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no vendor advisory, patch commit, or fixed package evidence currently tracked from any monitored source).

1) Immediate mitigations (no patch available):

• Restrict network access to the Flowise API (/api/v1/...), especially /api/v1/text-to-speech/abort, using a reverse proxy, WAF, or allowlist so the endpoint is not reachable by unauthenticated internet clients.
• Enforce authentication and session ownership at the edge: bind any abort call to the same authenticated principal/session that owns the chatflowId/chatId (interim compensating control if you operate a custom gateway in front of Flowise).
• Monitor for bursts of POST /api/v1/text-to-speech/abort requests carrying chatflowId/chatId from multiple or unfamiliar source IPs (see Detection Guidance) and rate-limit the endpoint.
• Treat chatflowId/chatId values as sensitive; avoid exposing them in public links, chat widgets, or logs where third parties can harvest them.

2) Patch / upgrade steps:

• Upgrade Flowise to 3.1.4 or later once the vendor release is available and verified. The NVD description identifies 3.1.4 as the fixed version; confirm against the official Flowise release notes / advisory before deploying.
• Validate that the updated handler enforces ownership verification on chatflowId and chatId before aborting a prediction.
• Because no patch artifact is currently tracked (Patch Confidence 0/4), verify the version string and behavior post-upgrade rather than relying on an unverified advisory.

3) Long-term hardening:

• Apply consistent authorization checks across all state-changing endpoints, not just the abort path — the root cause is a missing-ownership check (CWE-862), which may recur in sibling endpoints.
• Adopt object-level authorization (per-session ownership binding) as a standard for any endpoint accepting resource identifiers.
• Add automated regression tests that assert unauthenticated/foreign-session abort requests are rejected.
• Deploy continuous API inventory and rate-limiting; log and alert on anomalous abort-endpoint traffic.

References

1. NVD — CVE-2026-90535: https://nvd.nist.gov/vuln/detail/CVE-2026-90535
2. FIRST EPSS — not yet scored for CVE-2026-90535 (verify at https://api.first.org/data/v1/epss?cve=CVE-2026-90535)
3. MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
4. MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
5. Flowise project repository / release notes (verify the 3.1.4 fix): https://github.com/FlowiseAI/Flowise

Threat actor / exploit-in-the-wild evidence: None currently tracked. CISA KEV: NO. No public PoC, exploit code, or Nuclei template is known for CVE-2026-90535. Any campaign or in-the-wild activity reported against this CVE should be verified against vendor and government advisories before being treated as confirmed.