Credential Exposure in Flowise by FlowiseAI

CVE-2026-73604

What is CVE-2026-73604?

The Flowise application, prior to version 3.1.3, is susceptible to an incomplete credential redaction vulnerability within its API endpoint: GET /api/v1/credentials/:id. This flaw allows authenticated users with credentials:view permission to access sensitive information, which may include decrypted database connection URLs containing embedded passwords, sensitive cloud service account JSON files with private keys, and various API keys. The exposure of such critical data could lead to further security breaches and unauthorized access.

References