CVE-2026-41278: Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs

CVE-2026-41278 · Severity: high · CVSS 7.5 · Published 2026-04-23

Flowise is an open-source platform for building and deploying conversational AI chatflows. Public chatflow endpoints leak plaintext API keys, passwords, credential IDs, and internal node configurations without any sanitization. An unauthenticated attacker can access these sensitive credentials from any public chatflow, enabling direct compromise of third-party integrations and internal system manipulation.

Technologies: FlowiseAI Flowise, flowise (npm). Vendors: FlowiseAI, npm.

Quick answers

Is CVE-2026-41278 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41278 being exploited in the wild.
How severe is CVE-2026-41278?
High severity, with a CVSS score of 7.5, published 23 April 2026.
Which products and versions are affected?
flowise (npm) <= 3.0.13, SEMVER:introduced=0,fixed=3.1.0.
Is there a fix for CVE-2026-41278?
Yes. flowise (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41278 attacked?
It is attacked over the network.
Am I affected by CVE-2026-41278?
Check whether you run FlowiseAI Flowise or flowise (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • flowise (npm): upgrade to 3.1.0 or later
    npm install flowise@3.1.0

Technical details

The GET /api/v1/public-chatflows/:id and /public-chatbotConfig endpoints return the complete flowData object without sanitization for public chatflows. The root cause is in packages/server/src/controllers/chatflows/index.ts (lines 218–220), where the endpoint directly returns the raw chatflow object when isPublic is true. The sanitizeFlowDataForPublicEndpoint function does not exist in released v3.0.13, and even in unreleased HEAD, it is only called by public-chatbotConfig but not public-chatflows. An attacker with network access (no authentication required) can retrieve credential IDs, plaintext passwords, API keys, and secretKey fields from flowData, enabling OAuth2 token theft, direct third-party account compromise, and reconnaissance. The vulnerability is fixed in version 3.1.0.

Affected products

  • FlowiseAI Flowise <= 3.0.13

Identifiers

  • CVE-2026-41278
  • GHSA-w47f-j8rh-wx87

Timeline

  • 2026-04-17: disclosed
  • 2026-04-17: patched: patch available in version 3.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.