CVE-2026-41266CWE-200CWE-522CWE-862

Flowise: Sensitive Data Leak in public-chatbotConfig

High · published April 23, 2026

CVSS v4.0
7.7
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration without any authentication. An attacker with knowledge just of a chatflow UUID can retrieve credentials stored in password type fields and HTTP headers, leading to credential theft and more. This vulnerability is fixed in 3.1.0.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00501 · 42.0th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-522 · Insufficiently Protected Credentials; CWE-862 · Missing Authorization
Published
2026-04-23T19:11Z
EPSS history
Timeline
  • 23 APR 19:11Z
    Flowise: Sensitive Data Leak in public-chatbotConfig
    cvelistv5