CVE-2026-56278: Flowise hardcoded default secret

CISO Take

Flowise versions before 3.1.0 ship with a hardcoded fallback secret ('flowise') for signing express-session cookies whenever operators forget to set EXPRESS_SESSION_SECRET, and because that string lives in public source code, anyone can forge a validly-signed session cookie and impersonate any user, including admins, with zero credentials. This is a full authentication bypass (CVSS 9.1, AV:N/AC:L/PR:N/UI:N) on a widely deployed open-source AI agent-building platform that typically holds LLM API keys, vector-DB credentials, and business logic inside its flows — a successful forgery hands the attacker the keys to the whole AI stack, not just a web app login. It is not in CISA KEV and EPSS sits at 0.38% (top 70th percentile), and no public exploit or Nuclei template exists yet, so there is no evidence of active mass exploitation today — but the trivial exploitability (the secret is public, no scanning or brute force needed) means that calculus can flip the moment a PoC or scanner template lands. Confirm EXPRESS_SESSION_SECRET is explicitly set to a unique, high-entropy value in every Flowise deployment (self-hosted or cloud), upgrade to 3.1.0+ regardless, and rotate/invalidate all existing sessions after remediation since any cookie signed with the default secret must be treated as compromised.

Sources: NVD CISA KEV EPSS GitHub Advisory vulncheck.com ATLAS

What is the risk?

Critical severity is justified by the combination of network-reachable attack surface, zero required privileges, zero user interaction, and a secret that is trivially known (it is a literal string in the public GitHub repo, not something requiring brute force or leakage). This is effectively a 'skeleton key' vulnerability: any Flowise instance deployed with default configuration is exploitable by anyone who can craft an express-session cookie, which is a well-documented, low-skill technique. The only mitigating factor keeping this from being an active-exploitation emergency today is the absence of a KEV listing, public PoC, or scanner template, and a modest EPSS score — but those are lagging indicators, not evidence of low risk, given how mechanical the exploit is once discovered. Confidentiality and integrity impact are both high (full account impersonation); availability impact is none, since this is an auth bypass, not a disruption vector.

How does the attack unfold?

Fingerprint Flowise instance

Attacker identifies a public-facing Flowise deployment running a pre-3.1.0 version without a custom EXPRESS_SESSION_SECRET configured.

AML.T0049

Forge session cookie

Using the hardcoded default secret 'flowise' visible in the open-source codebase, the attacker signs a valid express-session cookie for an arbitrary or targeted user ID.

AML.T0091

Authenticate as impersonated user

The forged cookie is submitted to the Flowise UI/API and accepted as a legitimate session, granting full access without any credentials.

AML.T0012

Harvest credentials and control flows

Acting with impersonated privileges, the attacker exports flows containing LLM/vector-DB API keys and modifies agent configurations to exfiltrate data or pivot further.

AML.T0083

Fingerprint Flowise instance

Attacker identifies a public-facing Flowise deployment running a pre-3.1.0 version without a custom EXPRESS_SESSION_SECRET configured.

AML.T0049

Forge session cookie

Using the hardcoded default secret 'flowise' visible in the open-source codebase, the attacker signs a valid express-session cookie for an arbitrary or targeted user ID.

AML.T0091

Authenticate as impersonated user

The forged cookie is submitted to the Flowise UI/API and accepted as a legitimate session, granting full access without any credentials.

AML.T0012

Harvest credentials and control flows

Acting with impersonated privileges, the attacker exports flows containing LLM/vector-DB API keys and modifies agent configurations to exfiltrate data or pivot further.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

9.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A None

What should I do?

1 step

1) Upgrade to Flowise 3.1.0 or later immediately. 2) Regardless of version, explicitly set EXPRESS_SESSION_SECRET to a unique, randomly generated, high-entropy value in every environment (self-hosted, Docker, cloud) — never rely on the application default. 3) Treat any session cookie issued before remediation as potentially forgeable and force session invalidation / require re-authentication for all users after rotating the secret. 4) Audit access and admin action logs for anomalous session activity (logins without corresponding credential submission, unfamiliar session tokens, actions inconsistent with a known user's usage pattern) covering the exposure window. 5) Restrict network exposure of Flowise admin/API endpoints where possible (VPN, IP allowlisting) as defense-in-depth while patching rolls out fleet-wide.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0002 - Acquire Public AI Artifacts AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0083 - Credentials from AI Agent Configuration AML.T0091 - Use Alternate Authentication Material

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.6 - Information security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-56278?

Flowise versions before 3.1.0 ship with a hardcoded fallback secret ('flowise') for signing express-session cookies whenever operators forget to set EXPRESS_SESSION_SECRET, and because that string lives in public source code, anyone can forge a validly-signed session cookie and impersonate any user, including admins, with zero credentials. This is a full authentication bypass (CVSS 9.1, AV:N/AC:L/PR:N/UI:N) on a widely deployed open-source AI agent-building platform that typically holds LLM API keys, vector-DB credentials, and business logic inside its flows — a successful forgery hands the attacker the keys to the whole AI stack, not just a web app login. It is not in CISA KEV and EPSS sits at 0.38% (top 70th percentile), and no public exploit or Nuclei template exists yet, so there is no evidence of active mass exploitation today — but the trivial exploitability (the secret is public, no scanning or brute force needed) means that calculus can flip the moment a PoC or scanner template lands. Confirm EXPRESS_SESSION_SECRET is explicitly set to a unique, high-entropy value in every Flowise deployment (self-hosted or cloud), upgrade to 3.1.0+ regardless, and rotate/invalidate all existing sessions after remediation since any cookie signed with the default secret must be treated as compromised.

Is CVE-2026-56278 actively exploited?

No confirmed active exploitation of CVE-2026-56278 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56278?

1) Upgrade to Flowise 3.1.0 or later immediately. 2) Regardless of version, explicitly set EXPRESS_SESSION_SECRET to a unique, randomly generated, high-entropy value in every environment (self-hosted, Docker, cloud) — never rely on the application default. 3) Treat any session cookie issued before remediation as potentially forgeable and force session invalidation / require re-authentication for all users after rotating the secret. 4) Audit access and admin action logs for anomalous session activity (logins without corresponding credential submission, unfamiliar session tokens, actions inconsistent with a known user's usage pattern) covering the exposure window. 5) Restrict network exposure of Flowise admin/API endpoints where possible (VPN, IP allowlisting) as defense-in-depth while patching rolls out fleet-wide.

What systems are affected by CVE-2026-56278?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, model serving, vector databases.

What is the CVSS score for CVE-2026-56278?

CVE-2026-56278 has a CVSS v3.1 base score of 9.1 (CRITICAL). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesmodel servingvector databases

MITRE ATLAS Techniques

AML.T0002 Acquire Public AI Artifacts

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0083 Credentials from AI Agent Configuration

AML.T0091 Use Alternate Authentication Material

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

Exploitation Scenario

An attacker scans for internet-facing Flowise instances and fingerprints the version as pre-3.1.0. Knowing from the public GitHub source that the express-session middleware falls back to the hardcoded secret 'flowise' when EXPRESS_SESSION_SECRET is unset, the attacker crafts a session cookie signed with that secret, setting the session's user ID to that of a known or guessed admin account. The attacker submits this forged cookie to the Flowise web UI or API and is granted a fully authenticated session with no password, MFA, or credential of any kind. From there, the attacker browses and exports existing chatflows to harvest embedded LLM provider API keys and vector database credentials, modifies flows to add malicious tool calls or exfiltration steps, and pivots into any backend systems the flows were authorized to reach — all while appearing in logs as legitimate activity by the impersonated user.

Weaknesses (CWE)

CWE-798 Use of Hard-coded Credentials Primary CWE-798 Use of Hard-coded Credentials

CWE-798 — Use of Hard-coded Credentials: The product contains hard-coded credentials, such as a password or cryptographic key.

[Architecture and Design] For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible [REF-7]. In Windows environments, the Encrypted File System (EFS) may provide some protection.
[Architecture and Design] For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key.

Source: MITRE CWE corpus.