Description
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FlowiseAI | Flowise | < 3.1.3 | 3.1.3 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | flowise | < 3.1.3 | 3.1.3 | GHSA-rwrp-9823-p2xq |
References
- GitHub Security Advisory (GHSA-rwrp-9823-p2xq) vendor-advisory
- VulnCheck Advisory: Flowise before 3.1.3 Credential Exposure via API third-party-advisory