CVE-2026-73604
MediumCVSS 6.5Summary
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.
Risk Assessment
The risk includes exposure of sensitive credentials, which can lead to unauthorized access to databases, cloud services, and other resources. Confidentiality breach can have serious consequences for the organization.
Recommendation
It is recommended to immediately upgrade Flowise to version 3.1.3 or later. Also restrict credentials:view permission to trusted users only and monitor access to this endpoint.
Original NVD description (English source)
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.