CVE-2026-73604

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
FlowiseAI	Flowise	< 3.1.3

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xqExploit, Mitigation, Vendor Advisory
https://www.vulncheck.com/advisories/flowise-before-credential-exposure-via-apiThird Party Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xqExploit, Mitigation, Vendor Advisory

Timeline

Published: Aug 13, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-736055.8SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to prob CVE-2026-736065.8SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check passw CVE-2026-736075.8SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs n CVE-2026-736088.6SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4) contains a missing CVE-2026-736095.8SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark la CVE-2026-73618.8Use after free in iOS in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafte CVE-2026-736105.8SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire st CVE-2026-736116.8File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default CVE-2026-736128.1File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing a CVE-2026-736138.2filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allo CVE-2026-736148.8Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code ex CVE-2026-736158.8Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quo