Information Disclosure Vulnerability in Flowise API Endpoint

CVE-2026-56268

What is CVE-2026-56268?

Flowise, prior to version 3.1.2, is susceptible to an information disclosure vulnerability in its API endpoint /api/v1/chatflows/apikey/:apikey. When the keyonly query parameter is not included, the endpoint fails to filter results by workspace, inadvertently exposing all chatflows that lack an API key. Consequently, a malicious actor with a legitimate API key from one workspace can gain access to sensitive configurations from all unprotected chatflows across different workspaces, including the flowData, chatbot configurations, and API credentials. This vulnerability underscores the necessity for stricter access controls and proper filtering mechanisms.

References