FlowiseAI Flowise CVE-2026-8026

Q: What is the CVSS score of CVE-2026-8026?

CVE-2026-8026 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27824 MEDIUM

Information Exposure (CWE-200)

2026-05-06 VulDB

GHSA-8f47-4rh3-x44m

Information Disclosure Flowise

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 14:01 vuln.today

Severity Changed

May 06, 2026 - 13:22 NVD

LOW MEDIUM

CVSS changed

May 06, 2026 - 13:22 NVD

3.7 (LOW) 6.3 (MEDIUM)

DescriptionCVE.org

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.

AnalysisAI

Information disclosure in FlowiseAI Flowise up to version 3.0.12 allows remote attackers to extract sensitive data through the Login function in the API Response Handler component. The vulnerability requires high attack complexity and is difficult to exploit, but successful exploitation results in confidentiality impact without authentication requirements. No public confirmation of active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in the Login function within packages/server/src/enterprise/services/account.service.ts, which handles authentication responses in the Flowise API layer. The flaw is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating improper data protection or overly permissive information exposure in the authentication response handler. The API Response Handler component processes login requests and constructs responses; the flaw likely permits attackers to extract sensitive account or system information through crafted requests or response manipulation despite authentication controls.

RemediationAI

Upgrade FlowiseAI Flowise to version 3.0.13 or later to remediate this vulnerability; a patched version addressing the Login function information disclosure has been made available. Users should apply the upgrade immediately for internet-facing deployments. If upgrade is not immediately possible, restrict network access to the Flowise API endpoint using network segmentation, firewall rules, or reverse proxy authentication to limit exposure to trusted internal networks only. Monitor API response logs for unusual Login function calls or responses containing unexpected sensitive data leakage. No configuration-level workaround is available; patching is the primary remediation path.