CVE-2026-73604CWE-200information-disclosure

CVE-2026-73604

Medium · published August 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
34.3
In the wild
Unconfirmed
What it is

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00412 · 34.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-08-13T16:17Z
Affected products (1)
ProductVersionsFixed in
flowiseai/flowise< 3.1.33.1.3
References (3)
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq · [email protected]https://www.vulncheck.com/advisories/flowise-before-credential-exposure-via-api · [email protected]https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 13 AUG 11:28Z
    Flowise before 3.1.3 Credential Exposure via API
    cvelistv5