CVE-2026-73604 - Flowise before 3.1.3 Credential Exposure via API

Back Back to CVE browser

HIGH

Flowise before 3.1.3 Credential Exposure via API

Published Aug 13, 2026

7.1

HIGH

CVSS 4.0

EPSS 0.41%

Description

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.

Affected products

Vendor FlowiseAI Product Flowise Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.1.3
- Version
  3.1.3
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FlowiseAI

Flowise

unaffected

Version	Status	Constraints
0	affected	<3.1.3
3.1.3	unaffected	-

Ecosystem	Package	Introduced	Fixed
npm	flowise	0	3.1.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57808
Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq
exploitvendor-advisoryMitigationVendor Advisory
https://www.vulncheck.com/advisories/flowise-before-credential-exposure-via-api
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57808		Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq		exploitvendor-advisoryMitigationVendor Advisory
https://www.vulncheck.com/advisories/flowise-before-credential-exposure-via-api		third-party-advisoryThird Party Advisory