Sensitive Data Exposure in Flowise Drag & Drop User Interface

CVE-2026-41266

What is CVE-2026-41266?

The Flowise drag & drop user interface, prior to version 3.1.0, is vulnerable to sensitive data exposure due to inadequate authentication protocols. Specifically, the /api/v1/public-chatbotConfig/:id endpoint allows an attacker to extract sensitive information such as stored API keys, authorization headers, and internal configuration details simply by possessing the chatflow UUID. This lack of secure access control endangers the integrity of stored credentials, potentially leading to significant security breaches. Users are advised to upgrade to version 3.1.0 or above to mitigate the risks associated with this vulnerability.

References