Flowise up to 3.0.x Environment Variable tempTokenUtils.ts meta hard-coded credentials

Summaryinfo

A vulnerability has been found in Flowise up to 3.0.x and classified as critical. The impacted element is an unknown function of the file packages/server/src/enterprise/utils/tempTokenUtils.ts of the component Environment Variable Handler. Performing a manipulation of the argument meta results in hard-coded credentials. This vulnerability is known as CVE-2026-56269. Attacking locally is a requirement. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Flowise up to 3.0.x. This affects an unknown part of the file packages/server/src/enterprise/utils/tempTokenUtils.ts of the component Environment Variable Handler. The manipulation of the argument meta with an unknown input leads to a hard-coded credentials vulnerability. CWE is classifying the issue as CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKEN_HASH_SECRET environment variable in packages/server/src/enterprise/utils/tempTokenUtils.ts when the variable is not configured. This secret derives the AES-256-CBC key used to encrypt user IDs and workspace IDs in the 'meta' field of JWT tokens. An attacker who knows the default secret can decrypt this metadata to extract internal user and workspace identifiers, and re-encrypt manipulated values such as altered user or workspace IDs. Because the JWT signature is validated separately, decrypting or tampering with this metadata does not by itself grant access, but the disclosure of internal identifiers and possible metadata manipulation could aid privilege escalation or unauthorized data access.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-56269 since 06/20/2026. The exploitability is told to be difficult. Attacking locally is a requirement. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

Upgrading to version 3.1.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Flowise

Version

• 3.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion