Which versions of Flowise are affected by EUVD-2026-25297?

FlowiseAI Flowise versions before 3.1.0 expose plaintext API keys and credentials through unauthenticated public endpoints, allowing remote attackers to retrieve sensitive authentication material…. A patch is available.

How to fix or mitigate EUVD-2026-25297?

Within 24 hours, inventory all systems running FlowiseAI Flowise and identify instances running versions prior to 3.1.0, particularly those with public-facing chatflows. Within 7 days, upgrade all affected Flowise deployments to version 3.1.0 or later and validate the sanitizeFlowDataForPublicEndpoint helper is functioning properly in the patched build. Within 30 days, conduct a security audit to identify which credentials may have been exposed through the public endpoints, rotate all API keys and passwords that were stored in affected Flowise configurations, and review access logs for signs of unauthorized credential usage or account compromise.

Flowise EUVD-2026-25297

Q: What is the CVSS score of EUVD-2026-25297?

EUVD-2026-25297 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-41278 HIGH

Information Exposure (CWE-200)

2026-04-23 security-advisories@github.com

GHSA-w47f-j8rh-wx87

Information Disclosure Docker Flowise Flowiseai

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network GET against public chatflows (AV:N/AC:L/PR:N/UI:N); read-only secret disclosure gives C:H with no integrity or availability impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 03:42 vuln.today

Analysis Generated

Jul 24, 2026 - 03:42 vuln.today

Patch released

Apr 24, 2026 - 16:31 nvd

Patch available

Apr 23, 2026 - 22:16 EUVD

EUVD ID Assigned

Apr 23, 2026 - 20:26 euvd

EUVD-2026-25297

CVE Published

Apr 23, 2026 - 20:16 nvd

HIGH 8.7

DescriptionGitHub Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GET /api/v1/public-chatflows/:id endpoint returns the full chatflow object without sanitization for public chatflows. Docker validation revealed this is worse than initially assessed: the sanitizeFlowDataForPublicEndpoint function does NOT exist in the released v3.0.13 Docker image. Both public-chatflows AND public-chatbotConfig return completely raw flowData including credential IDs, plaintext API keys, and password-type fields. This vulnerability is fixed in 3.1.0.

AnalysisAI

Information disclosure in FlowiseAI Flowise before 3.1.0 exposes plaintext credentials through the unauthenticated GET /api/v1/public-chatflows/:id and public-chatbotConfig endpoints, which return the full raw flowData for any chatflow flagged public. Because the sanitizeFlowDataForPublicEndpoint helper is absent from the released v3.0.13 Docker image, remote attackers can retrieve credential IDs, plaintext API keys, and password-type fields without authentication. No public exploit is identified at time of analysis and EPSS probability is low (0.04%), but the disclosure is trivially automatable per CISA SSVC.

Technical ContextAI

Flowise is a Node.js/TypeScript low-code platform for visually composing LLM pipelines, where each 'chatflow' is stored as a serialized flowData JSON blob embedding node configurations - including credential references and secret inputs such as apiKey, password, and secretKey fields. The root cause is CWE-200 (Exposure of Sensitive Information): in packages/server/src/controllers/chatflows/index.ts, when chatflow.isPublic is true the controller returns the entire chatflow object verbatim (res.status(OK).json(chatflow)) with no filtering. The intended sanitizeFlowDataForPublicEndpoint routine (packages/server/src/utils/sanitizeFlowData.ts) exists only in unreleased HEAD, and even there is wired only into public-chatbotConfig and never into public-chatflows, so shipped builds leak secrets from both endpoints. Affected component per CPE is cpe:2.3:a:flowiseai:flowise across all versions up to 3.0.13.

RemediationAI

Upgrade to Flowise 3.1.0, which adds sanitization stripping credential, password, apiKey, and secretKey fields from flowData on the public endpoints (Vendor-released patch: 3.1.0), per GHSA-w47f-j8rh-wx87. Rebuild or repull the Docker image rather than relying on a cached v3.0.13 layer, since the released image lacked the fix entirely. Until you can patch, unpublish any public chatflows (unset the isPublic flag) so the vulnerable code path returns 403/404 instead of raw data - the trade-off is that legitimately embedded/public chatbots go offline. Alternatively, place the /api/v1/public-chatflows and /api/v1/public-chatbotConfig routes behind a reverse-proxy allowlist or authentication gate, accepting that this may break anonymous chatbot widgets. Critically, treat any credentials, API keys, or passwords that were ever present in a public chatflow as compromised and rotate them, because patching does not undo prior exposure.