CVE-2026-73604: Flowise: API leaks decrypted credentials in plaintext

MEDIUMPoC AVAILABLE

Published August 13, 2026

CISO Take

Flowise's credential retrieval endpoint fails to redact secrets, so any authenticated user holding the credentials:view permission can pull database connection strings, cloud service-account private keys, and third-party API keys in cleartext by simply calling GET /api/v1/credentials/:id. This matters because Flowise centralizes the secrets that wire agent workflows to LLM APIs, vector stores, and downstream databases, so a single over-permissioned account becomes a master key to the rest of the stack rather than just to the automation tool itself. Exploitation likelihood is low today — EPSS sits at 0.28% (top 79th percentile), there's no public exploit or Nuclei template, and it's not in CISA KEV — but the barrier to abuse is trivial once the permission is granted, making this an insider-risk and over-provisioning problem more than an internet-scanning one. Upgrade to Flowise 3.1.3 or later immediately, audit who currently holds credentials:view, and rotate any secret that permission could have exposed, since patching alone doesn't undo prior overexposure.

Sources:NVDGitHub AdvisoryEPSSATLASvulncheck.com

What is the risk?

Medium severity (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) — confidentiality impact is high with no integrity or availability effect. The requirement for authentication plus the credentials:view permission substantially narrows the exploitable population compared to an unauthenticated flaw, which is reflected in the low EPSS (0.28%, top 79th percentile), absence from CISA KEV, and lack of public exploit code or Nuclei coverage. Real-world risk is driven less by opportunistic scanning and more by insider threat, compromised low-privilege accounts, or overly broad role assignments in multi-tenant Flowise deployments — a scenario that turns a single low-privilege compromise into full secrets exposure.

How does the attack unfold?

Initial Access

Adversary obtains or already holds an authenticated Flowise account with the credentials:view permission, often through a low-privilege collaborator or contractor grant.

AML.T0012

Discovery

Adversary enumerates existing credential entries via the Flowise UI or API to identify targets for retrieval.

AML.T0007

Exploitation

Adversary calls GET /api/v1/credentials/:id for each credential ID and receives the secret in plaintext instead of a redacted value.

AML.T0055

Impact

Adversary uses the harvested database passwords, cloud service-account keys, and API keys to access connected systems, exfiltrate data, or incur costs on AI vendor accounts.

AML.T0025

Initial Access

Adversary obtains or already holds an authenticated Flowise account with the credentials:view permission, often through a low-privilege collaborator or contractor grant.

AML.T0012

Discovery

Adversary enumerates existing credential entries via the Flowise UI or API to identify targets for retrieval.

AML.T0007

Exploitation

Adversary calls GET /api/v1/credentials/:id for each credential ID and receives the secret in plaintext instead of a redacted value.

AML.T0055

Impact

Adversary uses the harvested database passwords, cloud service-account keys, and API keys to access connected systems, exfiltrate data, or incur costs on AI vendor accounts.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

Upgrade Flowise to version 3.1.3 or later, which fixes the incomplete redaction. Until patched, restrict or revoke the credentials:view permission to the smallest possible set of trusted administrators — treat it as equivalent to root access to all connected systems. After patching, rotate every credential (DB passwords, cloud service-account keys, API keys) that was accessible to any account holding credentials:view, since the vulnerability may have already exposed them. Review Flowise access logs for calls to GET /api/v1/credentials/:id from unexpected accounts or at unusual volumes, and apply least-privilege role design going forward so credential visibility is scoped per-workspace rather than platform-wide.

How is it classified?

Data LeakagePrivacy ViolationAgentFrameworkAML.T0055- Unsecured Credentials AML.T0083- Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.2-Information security in the AI system lifecycle

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-73604?

Is CVE-2026-73604 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-73604, increasing the risk of exploitation.

How to fix CVE-2026-73604?

Upgrade Flowise to version 3.1.3 or later, which fixes the incomplete redaction. Until patched, restrict or revoke the credentials:view permission to the smallest possible set of trusted administrators — treat it as equivalent to root access to all connected systems. After patching, rotate every credential (DB passwords, cloud service-account keys, API keys) that was accessible to any account holding credentials:view, since the vulnerability may have already exposed them. Review Flowise access logs for calls to GET /api/v1/credentials/:id from unexpected accounts or at unusual volumes, and apply least-privilege role design going forward so credential visibility is scoped per-workspace rather than platform-wide.

What systems are affected by CVE-2026-73604?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, vector databases, model serving.

What is the CVSS score for CVE-2026-73604?

CVE-2026-73604 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesvector databasesmodel serving

MITRE ATLAS Techniques

AML.T0055Unsecured Credentials

AML.T0083Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.2

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.

Exploitation Scenario

A workspace collaborator or contractor is granted the credentials:view permission in Flowise simply to see which credentials exist for a project (a common, seemingly low-risk grant). Instead of receiving masked values, they enumerate credential IDs via the UI or by directly calling GET /api/v1/credentials/:id for each entry, and the API returns full plaintext secrets — a Postgres connection string with embedded password, a GCP service-account JSON with a private key, and an OpenAI/Anthropic API key. The attacker uses the database credentials to access production data directly, the cloud service-account key to pivot into the victim's cloud environment, and the LLM API key to run up costs or exfiltrate data through the vendor's API — all without ever needing to compromise Flowise's application server itself.

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimary CWE-200Exposure of Sensitive Information to an Unauthorized Actor

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.