PT-2026-34746 · Flowise · Flowise

Published 2026-04-17 · Updated 2026-04-23 · CVE-2026-41278

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description The 'GET /api/v1/public-chatflows/:id' endpoint returns the full chatflow object without sanitization for public chatflows. In the v3.0.13 Docker image, the sanitizeFlowDataForPublicEndpoint() function is missing, causing both public-chatflows and public-chatbotConfig to return raw flowData. This includes sensitive information such as credential IDs, plaintext API keys, and password-type fields.

Recommendations Update to version 3.1.0.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-41278

GHSA-W47F-J8RH-WX87

Affected Products

Flowise

References · 5

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w47f-j8rh-wx87 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41278 · Security Note
• https://osv.dev/vulnerability/GHSA-w47f-j8rh-wx87 · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://twitter.com/CVEnew/status/2047428068009259123 · Twitter Post