Flowise: Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Medium, CVSS 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Record
- CVE-2026-73604
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 13, 2026
- Source last modified
- October 24, 2026
Description
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.
Description quoted from the NVD record.