CVE-2026-56272 Details
Description
Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware, potentially compromising all user accounts in a database breach scenario.
A vulnerability exists in Flowise versions prior to 3.0.13, where the bcrypt password hashing algorithm is used with a default of 5 salt rounds. This configuration allows only 32 iterations, significantly below the OWASP-recommended minimum of 10 rounds. As a result, attackers can crack password hashes approximately 30 times faster using modern GPU hardware, potentially compromising all user accounts in the event of a database breach.
Users are advised to update to Flowise version 3.0.13 or later. For those using versions prior to 3.0.13, it is recommended to manually increase the bcrypt salt rounds to at least 10, as per OWASP guidelines.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x2g5-fvc2-gqvp | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/flowise-insufficient-password-salt-rounds-in-bcrypt-hashing | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.0.13 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |