Which versions of Flowise are affected by EUVD-2026-25283?

FlowiseAI Flowise versions before 3.1.0 contain an unauthenticated credential disclosure vulnerability allowing remote attackers to steal API keys and authentication tokens from deployed instances.. A patch is available.

How to fix or mitigate EUVD-2026-25283?

Within 24 hours, identify and document all Flowise instances in your environment, including version numbers and configured integrations. Within 7 days, upgrade all Flowise deployments to version 3.1.0 or later according to official release guidance. Within 30 days, verify successful patching, rotate any API keys or authentication tokens stored by Flowise as a precaution, and review access logs for requests to /api/v1/public-chatbotConfig/ endpoints to identify potential exploitation attempts.

Flowise EUVD-2026-25283

Q: What is the CVSS score of EUVD-2026-25283?

EUVD-2026-25283 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-41266 HIGH

Information Exposure (CWE-200)

2026-04-23 GitHub_M

GHSA-4jpm-cgx2-8h37

Information Disclosure Flowise

7.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Unauthenticated network read of stored credentials (C:H) with scope change since the leaked secrets grant access to other systems; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:34 vuln.today

Analysis Generated

Jul 24, 2026 - 04:34 vuln.today

Patch released

Apr 25, 2026 - 02:16 nvd

Patch available

Apr 23, 2026 - 21:01 EUVD

CVSS changed

Apr 23, 2026 - 20:26 NVD

7.7 (HIGH)

EUVD ID Assigned

Apr 23, 2026 - 20:00 euvd

EUVD-2026-25283

CVE Published

Apr 23, 2026 - 19:11 nvd

HIGH 7.7

DescriptionGitHub Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration without any authentication. An attacker with knowledge just of a chatflow UUID can retrieve credentials stored in password type fields and HTTP headers, leading to credential theft and more. This vulnerability is fixed in 3.1.0.

AnalysisAI

Unauthenticated sensitive data disclosure in FlowiseAI Flowise before 3.1.0 lets any remote party retrieve stored secrets by requesting /api/v1/public-chatbotConfig/:id with only a chatflow UUID. The endpoint returns the full flowData object - including plaintext password-type fields (e.g. Unstructured API keys), HTTP Authorization headers from Requests nodes, and internal endpoint/webhook URLs - with no authorization check, enabling credential theft and downstream pivoting. Publicly available exploit code exists (vendor GHSA advisory with PoC), though EPSS is very low (0.05%, 15th percentile) and it is not on CISA KEV.

Technical ContextAI

Flowise is a low-code drag-and-drop builder for LLM orchestration flows; each chatflow is persisted with a flowData object describing its nodes and their configured parameters. The root cause (CWE-200, Exposure of Sensitive Information to an Unauthorized Actor) is in the getSinglePublicChatbotConfig function in packages/server/src/services/chatflows/index.ts, which serves the entire flowData over a public endpoint without an authorization gate or field sanitization. A stale in-code assumption - a comment asserting 'chatbotConfig doesn't contain sensitive credential' - is wrong: node parameters typed as password (such as unstructuredAPIKey in the S3 File node) are stored in plaintext, and Requests POST/GET nodes embed their Authorization headers, all of which are returned verbatim. The single CPE in scope is cpe:2.3:a:flowiseai:flowise, covering all builds up to and including 3.0.13.

RemediationAI

Vendor-released patch: 3.1.0 - upgrade Flowise to 3.1.0 or later, which adds the missing authorization check / sanitization on /api/v1/public-chatbotConfig/:id, as documented in GHSA-4jpm-cgx2-8h37 (https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4jpm-cgx2-8h37). If immediate upgrade is not possible, restrict or block external access to the /api/v1/public-chatbotConfig/ path at a reverse proxy or WAF (trade-off: breaks legitimately embedded public chat widgets that rely on this endpoint), and rotate any secrets that were configured in password-type fields or Requests-node Authorization headers since UUIDs may already have leaked. As a configuration workaround, avoid storing raw credentials in chatflow node fields - move secrets to server-side credential references rather than inline password fields where the platform supports it. After patching, treat any previously exposed API keys, bearer tokens, and webhook URLs as compromised and reissue them.