Flowise: Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Medium, CVSS 4.1
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
- Record
- CVE-2026-56272
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 24, 2026
- Source last modified
- October 25, 2026
Description
Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware, potentially compromising all user accounts in a database breach scenario.
Description quoted from the NVD record.