Executive brief
Flowise is an open-source platform for building and deploying conversational AI chatflows. Public chatflow endpoints leak plaintext API keys, passwords, credential IDs, and internal node configurations without any sanitization. An unauthenticated attacker can access these sensitive credentials from any public chatflow, enabling direct compromise of third-party integrations and internal system manipulation.
Technical details
The GET /api/v1/public-chatflows/:id and /public-chatbotConfig endpoints return the complete flowData object without sanitization for public chatflows. The root cause is in packages/server/src/controllers/chatflows/index.ts (lines 218–220), where the endpoint directly returns the raw chatflow object when isPublic is true. The sanitizeFlowDataForPublicEndpoint function does not exist in released v3.0.13, and even in unreleased HEAD, it is only called by public-chatbotConfig but not public-chatflows. An attacker with network access (no authentication required) can retrieve credential IDs, plaintext passwords, API keys, and secretKey fields from flowData, enabling OAuth2 token theft, direct third-party account compromise, and reconnaissance. The vulnerability is fixed in version 3.1.0.
Affected products
- FlowiseAI Flowise <= 3.0.13
Timeline
- 2026-04-17: disclosed
- 2026-04-17: patched: patch available in version 3.1.0