GHSA-4jpm-cgx2-8h37: Flowise: unauth API exposes plaintext API keys and tokens

### Summary `/api/v1/public-chatbotConfig/:id `ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration without any authentication. An attacker with knowledge just of a chatflow UUID can retrieve credentials stored in password type fields and HTTP headers, leading to credential theft and more. ### Details Knowledge of chatflow UUID can be obtained from embedded chat widgets, referrer headers or logs and it's the only prerequest. `getSinglePublicChatbotConfig` function in `packages/server/src/services/chatflows/index.ts` returns the full **flowData** object without authorization check or data sanitization. There is a comment as **"Safe as public endpoint as chatbotConfig doesn't contain sensitive credential"** but **flowData** does contain sensitive data such as: `type: 'password'` fields are stored in plaintext (unstructuredAPIKey in S3File node). HTTP Authorization headers in POST / GET Requests nodes. Internal API endpoints and webhook URLs. ### PoC - Add an S3 File node, set "File Processing Method" to "Unstructured". - Enter an API key in "Unstructured API KEY" field or add a Requests Post node with Authorization header. - Save the chatflow. `curl -s "https://localhost/api/v1/public-chatbotConfig/{CHATFLOW_UUID}"` Response: ``` { "flowData": "{...\"unstructuredAPIKey\":\"victim_key\"...\"requestsPostHeaders\":\"Bearer victim_token\"...}" } ``` ### Impact Impacts all Flowise Cloud users with chatflows containing password type fields or any HTTP headers. And self hosted Flowise instances exposed to the internet.

An attacker identifies a victim company using Flowise by finding an embedded chat widget on their website. The attacker extracts the chatflow UUID from the widget's JavaScript initialization code or intercepts it via browser DevTools network tab — no authentication required. They issue a single unauthenticated curl request to /api/v1/public-chatbotConfig/{UUID} and receive the full flowData JSON response containing plaintext AWS S3 credentials via the Unstructured node and a Bearer token for an internal API. The attacker uses the S3 credentials to exfiltrate sensitive documents and the Bearer token to access internal tooling, all without ever interacting with the AI model itself.