CVE-2026-73604 in Flowise
Summary
by MITRE • 08/13/2026
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability exists within Flowise version 3.1.2 and earlier, specifically in the GET /api/v1/credentials/:id endpoint where credential redaction mechanisms fail to properly sanitize sensitive information. This represents a critical security flaw that directly violates fundamental principles of information security and data protection. The incomplete credential redaction vulnerability allows authenticated users with minimal privileges to access plaintext secrets that should remain encrypted or redacted during transmission, creating a significant risk for organizations relying on the platform for workflow automation and integration management.
This technical flaw operates at the application layer and specifically targets the credential management functionality within Flowise's API architecture. The vulnerability manifests when legitimate users with credentials:view permission make requests to the designated endpoint, bypassing proper access controls that should prevent exposure of decrypted secrets. The system fails to implement adequate sanitization procedures that would normally redact sensitive components such as passwords embedded in database URLs, private keys contained within cloud service account JSON files, and various API keys that are stored in encrypted formats but retrieved in plaintext during the GET operation.
The operational impact of this vulnerability extends beyond simple data exposure, creating potential for severe downstream consequences including unauthorized access to backend systems, compromise of cloud infrastructure, and elevation of privileges through stolen credentials. Attackers could leverage this vulnerability to gain persistent access to databases, cloud storage systems, and third-party services that rely on the exposed API keys and connection strings. The vulnerability directly maps to CWE-209 Information Exposure Through an Error Message and CWE-540 Inclusion of Sensitive Information in Source Code, as it exposes sensitive data during normal operational procedures rather than through error conditions or development artifacts.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1566.002 Credential Access: Phishing for Credentials and T1528 Steal Application Access Token within the credential abuse category. The flaw enables adversaries to harvest credentials without requiring sophisticated attack vectors or exploitation techniques, making it particularly dangerous in environments where multiple users have access to the platform. Organizations using Flowise for enterprise automation workflows face increased risk of data breaches, regulatory violations, and compliance failures when this vulnerability remains unaddressed.
The recommended remediation involves implementing proper credential redaction mechanisms that ensure sensitive information is never exposed during API responses regardless of user permissions or authentication status. Security measures should include comprehensive input validation, output sanitization, and proper encryption handling throughout the credential management process. Additionally, organizations should enforce principle of least privilege access controls, implement regular security audits of credential storage systems, and establish monitoring procedures to detect unauthorized access attempts. The fix must ensure that all sensitive data remains encrypted during transmission and only decrypted within secure, isolated environments as part of proper security architecture design principles.