CVE-2026-73604
Received Received - Intake

Flowise Credential Disclosure via Incomplete Redaction Before 3.1.3

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73604
EUVD
EUVD-2026-57808

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flowiseai flowise to 3.1.3 (exc)
flowiseai flowise 3.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Flowise before version 3.1.3 has an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint. This means the API returns decrypted secrets in plaintext instead of properly hiding them. Authenticated users with credentials:view permission can access sensitive data like database passwords, cloud service account private keys, and API keys through this endpoint.

Detection Guidance

To detect this vulnerability, check Flowise API responses for the GET /api/v1/credentials/:id endpoint. Look for plaintext secrets in fields like plainDataObj, especially in database connection URLs, cloud service account JSON, or API keys. Use tools like curl to query the endpoint with valid credentials and inspect the output for exposed sensitive data.

Impact Analysis

An attacker with access could steal database credentials, cloud service account keys, or API keys. This could lead to unauthorized database access, cloud service breaches, or API abuse. In multi-user workspaces, any user with view permissions could expose secrets of other users.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized exposure of personal data and HIPAA due to potential exposure of sensitive health information if stored in connected databases. It results in non-compliance with data protection requirements for handling sensitive credentials.

Mitigation Strategies

Upgrade Flowise to version 3.1.3 or later to apply the patch. Review API responses to ensure sensitive fields are properly redacted. Implement additional monitoring for unauthorized access to the /api/v1/credentials/:id endpoint. Restrict credentials:view permissions to only necessary users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73604. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart