CVE-2026-41266 Details
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration without any authentication. An attacker with knowledge just of a chatflow UUID can retrieve credentials stored in password type fields and HTTP headers, leading to credential theft and more. This vulnerability is fixed in 3.1.0.
A vulnerability in Flowise prior to version 3.1.0 allows for the unauthorized exposure of sensitive data through the public-chatbotConfig API endpoint. This endpoint reveals API keys, HTTP authorization headers, and internal configuration details without requiring authentication. An attacker who knows a chatflow UUID can access credentials stored in password fields and HTTP headers, leading to credential theft. The issue affects all Flowise Cloud users with chatflows containing password-type fields or HTTP headers, as well as self-hosted Flowise instances exposed to the internet.
Users can update to Flowise version 3.1.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4jpm-cgx2-8h37 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4jpm-cgx2-8h37 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 25, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 23, 2026 | New CVE Received | [email protected] |