CVE-2026-73604

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq	Exploit Mitigation Vendor Advisory
https://www.vulncheck.com/advisories/flowise-before-credential-exposure-via-api	Third Party Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*

History

23 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Flowise anterior a la versión 3.1.3 contiene una vulnerabilidad de redacción incompleta de credenciales en el endpoint GET /api/v1/credentials/:id que devuelve secretos descifrados en texto plano. Usuarios autenticados con permiso ’credentials:view’ pueden recuperar datos sensibles, incluyendo URLs de conexión a bases de datos con contraseñas incrustadas, JSON de cuentas de servicio en la nube con claves privadas, y claves de API al llamar a este endpoint.

Information

Published : 2026-08-13 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73604

Mitre link : CVE-2026-73604

CVE.ORG link : CVE-2026-73604

JSON object : View

Products Affected

flowiseai

flowise

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-73604", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73604", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T14:52:07.350749Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "FlowiseAI", "product": "Flowise", "versions": [{"status": "affected", "version": "0", "lessThan": "3.1.3", "versionType": "semver"}, {"status": "unaffected", "version": "3.1.3", "versionType": "semver"}], "packageURL": "pkg:npm/flowise", "defaultStatus": "unaffected"}]}], "published": "2026-08-13T12:17:24.750", "references": [{"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/flowise-before-credential-exposure-via-api", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint."}, {"lang": "es", "value": "Flowise anterior a la versi\u00f3n 3.1.3 contiene una vulnerabilidad de redacci\u00f3n incompleta de credenciales en el endpoint GET /api/v1/credentials/:id que devuelve secretos descifrados en texto plano. Usuarios autenticados con permiso \u2019credentials:view\u2019 pueden recuperar datos sensibles, incluyendo URLs de conexi\u00f3n a bases de datos con contrase\u00f1as incrustadas, JSON de cuentas de servicio en la nube con claves privadas, y claves de API al llamar a este endpoint."}], "lastModified": "2026-10-24T15:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C8B3FC2-6070-4400-9690-FCBE0C5C1D37", "versionEndExcluding": "3.1.3"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}