PT-2026-54029 · Flowise · Flowise

Kolega-Ai-Dev · Publicado 2026-06-30 · Atualizado 2026-06-30 · CVE-2026-56278

NVD

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS SESSION SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2026-56278

Produtos afetados

Flowise

Referências · 3

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2qqc-p94c-hxwh · Aviso do Fabricante
• https://vulncheck.com/advisories/flowise-session-hijacking-via-weak-default-express-session-secret · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56278 · Nota de Segurança