Flowise: Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Critical, CVSS 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Record
- CVE-2026-56278
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 30, 2026
- Source last modified
- July 6, 2026
Description
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.
Description quoted from the NVD record.
Who is affected
Flowise is a tool for building apps that use AI language models. This flaw affects versions 3.0.13 and earlier (all versions before 3.1.0). When no custom secret key for login sessions has been set, Flowise falls back to a weak built-in secret that anyone can look up. An attacker could use it to create fake login sessions, pretend to be any user, and get past the login. This flaw is rated Critical.
What to do
- If someone in your organization installed or runs Flowise, that person should check which version is in use.
- Update Flowise to version
3.1.0or later, which fixes this flaw. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update will be done.
- Because an attacker could pretend to be any user, treat this update as urgent rather than waiting for routine maintenance.
- For more details, read the vendor advisory linked on this page.
Analysis written from the source record as of July 6, 2026 and reviewed before publishing.