Vulnerability Description
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flowiseai | Flowise | < 3.1.3 |
Related Weaknesses (CWE)
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xqExploitMitigationVendor Advisory
- https://www.vulncheck.com/advisories/flowise-before-credential-exposure-via-apiThird Party Advisory
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xqExploitMitigationVendor Advisory
FAQ
What is CVE-2026-73604?
CVE-2026-73604 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credent...
How severe is CVE-2026-73604?
CVE-2026-73604 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-73604?
Check the references section above for vendor advisories and patch information. Affected products include: Flowiseai Flowise.