CVE-2026-91937

Executive Summary

CVE-2026-91937 is a NoSQL operator injection vulnerability (CWE-943) in Flowise, an open-source low-code platform for building LLM orchestration flows. Flowise versions before 3.1.4 fail to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries inside the MongoDBMemory node, allowing unauthenticated attackers to submit MongoDB operator objects through the prediction API to retrieve chat history records belonging to other users from the shared collection. With a CVSS base score of 7.5 (High) and a network-reachable, no-authentication-required attack vector, any internet-exposed Flowise instance is at risk of mass chat-history disclosure.

Technical Analysis

The root cause is improper neutralization of special elements used in a query — specifically MongoDB query operator injection, classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic). MongoDB queries are expressed as JSON/BSON documents. When an application accepts user-controlled input and passes it unmodified (rather than coerced to a primitive type such as a string) into a query filter, an attacker who can supply a JSON object instead of a scalar value can inject MongoDB query operators. The canonical example is supplying {"$ne": null} or {"$gt": ""} in a field position, which changes the semantics of the query from an equality match to a match-any condition, defeating the intended per-user filter.

In this CVE, the vulnerable data flow is:

1. A request reaches the prediction API (the endpoint that executes a chatflow/prediction request).
2. The request body includes an overrideConfig object containing a sessionId field.
3. The sessionId value is passed without sanitization into a MongoDB query executed by the MongoDBMemory node, whose purpose is to persist and retrieve conversation memory (chat history).
4. Because the value is not sanitized and is not forced to a string type, an attacker can replace the expected string sessionId with a MongoDB operator object.
5. The resulting query no longer constrains results to the attacker's own session, so records belonging to other users are returned from the shared collection.

The confidentiality impact is High (C:H) because the memory collection stores prior conversation content — potentially including sensitive user prompts, retrieved documents, credentials pasted into prompts, and business data. Integrity and Availability impacts are None (I:N/A:N); the attacker reads but does not modify or destroy data (per the assigned vector). The attack is unauthenticated (PR:N), network-reachable (AV:N), and requires no user interaction (UI:N), giving a low attack complexity (AC:L) once the endpoint and a valid chatflow identifier are known. The single mitigating factor is scope-unchanged (S:U): the compromise stays within the Flowise application/collection boundary rather than pivoting to other security authorities.

No public proof-of-concept, exploit code, or Nuclei template is known at the time of writing. The mechanism above is derived strictly from the operator-injection vulnerability class and the parameter/node names given in the NVD description.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (MongoDB operator injection) and the affected component named in the description. Only the identifiers overrideConfig.sessionId, the prediction API, the MongoDBMemory node, and the shared collection appear in the source data — no other endpoints or field names are asserted.

1. Reconnaissance / target identification. An attacker scans for internet-exposed Flowise instances (e.g., via Shodan using the dorks above) and identifies one running a version prior to 3.1.4. The attacker locates a chatflow/prediction entry point exposed by the deployment. No credentials are required.

2. Flaw-class trigger. The attacker crafts a prediction request whose overrideConfig.sessionId value is supplied as a JSON object carrying a MongoDB operator (e.g., a not-equal or greater-than operator) instead of a plain string. Because the parameter is neither sanitized nor type-constrained before being interpolated into the MongoDB query used by the MongoDBMemory node, the operator is interpreted by the database as query logic rather than data.

3. Payload / execution. Rather than the query being scoped to the attacker's own sessionId, the injected operator broadens the match (or short-circuits the filter), causing the query against the shared collection to return memory records for arbitrary sessions. The attacker iterates the request, harvesting returned chat-history records.

4. Post-exploitation impact. The attacker exfiltrates conversation memory belonging to other users from the shared collection. There is no write, delete, or code-execution primitive described. The primary risk is bulk, silent disclosure of sensitive conversational data at scale, with no authentication barrier.

Because no exploit artifacts are public, defenders should not wait for a signature-based PoC before validating exposure.

Impact Assessment

• Confidentiality: High (C:H). Unauthorized read of other users' chat history from the shared MongoDB collection. Memory records frequently contain sensitive prompt content.
• Integrity: None (I:N). No modification of data is described.
• Availability: None (A:N). No denial-of-service primitive is described.
• Attack Vector: Network (AV:N), Complexity: Low (AC:L), Privileges: None (PR:N), User Interaction: None (UI:N), Scope: Unchanged (S:U).
• Base Score: 7.5 (High).

Business impact. Flowise is commonly deployed by AI/ML teams to expose LLM chatflows, often internet-facing and frequently holding proprietary prompts, retrieved RAG documents, and customer conversations. Cross-tenant chat-history disclosure can constitute a data-breach event with regulatory (GDPR/CCPA) implications, especially in multi-tenant deployments where the "shared collection" holds records from many users. Blast radius: every unauthenticated network client capable of reaching the prediction API of an unpatched (<3.1.4) instance; the shared collection means one vulnerable deployment can expose the memory of its entire user base. No privilege escalation or lateral movement beyond the collection is implied by the vector.

Detection Guidance

Sigma Rule

Detects Flowise prediction API requests where the overrideConfig.sessionId value is a JSON object/operator rather than a string (web-application log / reverse-proxy layer).

title: Flowise MongoDB Operator Injection via overrideConfig.sessionId
id: 5b9f0c2e-7a41-4d8c-9e13-3f6a2c9d10aa
status: experimental
description: Detects MongoDB operator objects supplied in the overrideConfig.sessionId parameter of the Flowise prediction API (CVE-2026-91937).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91937
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/api/v1/prediction/'
  selection_param:
    cs-uri-query|contains: 'overrideConfig'
  selection_operator:
    cs-uri-query|contains:
      - '%24ne'
      - '%24gt'
      - '%24gte'
      - '%24lt'
      - '%24lte'
      - '%24regex'
      - '%24exists'
      - '%24in'
      - '%24nin'
      - '$ne'
      - '$gt'
      - '$regex'
  condition: selection_endpoint and selection_param and selection_operator
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate clients that serialize sessionId as an object (unexpected; investigate)
level: high

YARA Rule

Scans Flowise application source / bundled JS for unsanitized use of sessionId in MongoDB queries inside the MongoDBMemory node and for operator-injection patterns.

rule CVE_2026_91937_Flowise_MongoDB_Operator_Injection
{
    meta:
        description = "Detects Flowise MongoDBMemory node building queries from unsanitized overrideConfig.sessionId (CVE-2026-91937)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91937"
        date = "2026-01-01"
        severity = "high"

    strings:
        $node   = "MongoDBMemory" ascii wide nocase
        $sess   = "overrideConfig.sessionId" ascii wide nocase
        $pred   = "prediction" ascii wide nocase
        $mongo  = "mongodb" ascii wide nocase
        $op1    = "$ne" ascii
        $op2    = "$gt" ascii
        $op3    = "$regex" ascii

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or true) and
        $node and $mongo and
        ( $sess or $pred ) and
        any of ($op*)
}

Suricata IDS Rule

Detects HTTP requests to the Flowise prediction API carrying URL-encoded MongoDB operators alongside overrideConfig.

alert http any any -> any any (msg:"CVE-2026-91937 Flowise MongoDB Operator Injection via overrideConfig.sessionId"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/prediction/"; http.uri; content:"overrideConfig"; http.uri; pcre:"/%24(ne|gt|gte|lt|lte|regex|exists|in|nin)/Ui"; classtype:web-application-attack; reference:cve,2026-91937; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91937; sid:202691937; rev:1;)

Note: overrideConfig and the nested sessionId are typically transmitted in the JSON request body rather than the URL. If the deployment logs only the body, pair this rule with a body-inspecting rule (http.request_body; content:"overrideConfig"; content:"sessionId"; pcre:"/\x24(ne|gt|gte|lt|lte|regex|exists|in|nin)/Ui";).

Elastic Detection

EQL rule over web-access/proxy logs flagging prediction-API requests containing a MongoDB operator token.

network where
  http.request.method == "POST" and
  startsWith(http.request.uri.path, "/api/v1/prediction/") and
  (
    contains(http.request.uri.query, "overrideConfig") or
    contains(http.request.body, "overrideConfig")
  ) and
  (
    contains(http.request.uri.query, "%24ne") or contains(http.request.uri.query, "%24gt") or
    contains(http.request.uri.query, "%24regex") or
    contains(http.request.body, "\"$ne\"") or contains(http.request.body, "\"$gt\"") or
    contains(http.request.body, "\"$regex\"")
  )

Splunk SPL Query

Detects operator-injection attempts and anomalous bulk prediction-API access from a single source.

index=web OR index=flowise sourcetype=access_combined OR sourcetype=nginx:access
| eval uri_lc = lower(uri)
| where match(uri_lc, "/api/v1/prediction/")
| eval has_override = if(match(uri_lc, "overrideconfig") OR match(lower(_raw), "overrideconfig"), 1, 0)
| eval has_operator = if(match(lower(_raw), "\%24(ne|gt|gte|lt|lte|regex|exists|in|nin)") OR match(lower(_raw), "\"\$(ne|gt|gte|lt|lte|regex|exists|in|nin)\""), 1, 0)
| where has_override=1 AND has_operator=1
| stats count AS attempts dc(uri) AS distinct_uris values(status) AS statuses BY src_ip
| where attempts >= 5
| sort - attempts

Wazuh OSSEC Rule

Wazuh rule matching an nginx/Apache access-log entry for the operator-injection pattern, and a correlation rule for repeated attempts.

<group name="web,flowise,cve-2026-91937,">
  <rule id="100937" level="10">
    <if_sid>31100</if_sid>
    <field name="url">/api/v1/prediction/</field>
    <regex type="pcre2">overrideConfig.*%24(ne|gt|gte|lt|lte|regex|exists|in|nin)</regex>
    <description>CVE-2026-91937: Flowise prediction API MongoDB operator injection via overrideConfig.sessionId</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_scan,</group>
  </rule>

  <rule id="100938" level="12" frequency="5" timeframe="120">
    <if_matched_sid>100937</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-91937: repeated Flowise operator-injection attempts from same source (possible chat-history harvesting)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). The only patch signal available is an OSV entry; no vendor advisory or commit was provided. Treat remediation claims as unverified until confirmed against the Flowise project.

1) Immediate mitigations (if patching cannot be done at once):

• Remove internet exposure of the Flowise prediction API; restrict it behind authentication and network controls (VPN, IP allowlist, reverse-proxy auth).
• Enforce strict input typing at the edge: reject any request where overrideConfig.sessionId is not a plain string (defense-in-depth against operator-object submission for the vulnerability class).
• Isolate tenant memory data — avoid a single "shared collection" spanning all users where the architecture permits per-tenant separation.
• Monitor/block inbound requests containing MongoDB operator tokens ($ne, $gt, $regex, $exists, $in, $nin, etc.) in prediction-API traffic using the rules above.

2) Patch / upgrade:

• Upgrade Flowise to 3.1.4 or later, per the single-source patch claim. Verify the changelog/commit actually forces sessionId (and any query-derived parameter) to a string and/or validates it before it reaches the MongoDBMemory node query.
• Because patch confidence is low, confirm the fix independently (inspect the release commit or test with an operator-object payload in a controlled environment) before declaring closure.

3) Long-term hardening:

• Adopt typed parameter binding / explicit schema validation (e.g., force string casts) for all values that flow into datastore queries — the general remedy for CWE-943.
• Deploy the MongoDB layer with least privilege: the Flowise service account should only access the collections it needs, limiting cross-user read scope.
• Add regression tests that submit operator objects to query-derived parameters and assert they are rejected.
• Track Flowise advisories and integrate SCA/OSV scanning so future memory-node fixes are auto-flagged.

References

1. NVD — CVE-2026-91937: https://nvd.nist.gov/vuln/detail/CVE-2026-91937
2. Flowise project (vendor source / releases): https://github.com/FlowiseAI/Flowise
3. OSV — package/advisory entry referencing the claimed fix (single source): https://osv.dev/
4. CWE-943 — Improper Neutralization of Special Elements in Data Query Logic: https://cwe.mitre.org/data/definitions/943.html
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Exploit-in-the-wild / threat actor status: No public PoC, exploit code, or Nuclei template is known; CISA KEV does not list this CVE. No threat-actor campaign is documented at the time of writing. Detection guidance above is defense-oriented and based on the vulnerability class, not on observed exploit telemetry.