PT-2026-34731 · Flowise · Flowise

Published 2026-04-16 · Updated 2026-05-14 · CVE-2026-41266

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description The '/api/v1/public-chatbotConfig/:id' endpoint exposes sensitive data without requiring authentication. An attacker who possesses a chatflow UUID can retrieve internal configuration, HTTP authorization headers, and credentials stored in password type fields, which may lead to credential theft.

Recommendations Update to version 3.1.0.

Exploit

Fix

Missing Authorization

Insufficiently Protected Credentials

Information Disclosure

Weakness Enumeration

CWE-862

CWE-522

CWE-200

Related Identifiers

CVE-2026-41266

GHSA-4JPM-CGX2-8H37

Affected Products

Flowise

References · 6

• 🔥 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4jpm-cgx2-8h37 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41266 · Security Note
• https://osv.dev/vulnerability/GHSA-4jpm-cgx2-8h37 · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://twitter.com/CVEnew/status/2047428080340492723 · Twitter Post
• https://twitter.com/dailycve/status/2054962020332503506 · Twitter Post