Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq Exploit, Mitigation, Vendor Advisory
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.1 · flowiseaiNVD modified 2026-10-23 18:10
Affected (CPE criteria) 1
cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*
References 3
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq Exploit, Mitigation, Vendor Advisory
- https://www.vulncheck.com/advisories/flowise-before-credential-exposure-via-api Third Party Advisory
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq Exploit, Mitigation, Vendor Advisory