Executive brief
Flowise, an open-source tool for building LLM applications, uses a weak, hard-coded default secret for encrypting sensitive token metadata when a custom secret is not configured. If an attacker knows this default secret, they can decrypt and potentially manipulate internal identifiers like user and workspace IDs. This could lead to unauthorized access to data or privilege escalation within the platform.
Technical details
A hard-coded default value 'Secre$t' is used for the TOKEN_HASH_SECRET environment variable in Flowise versions up to 3.0.13. This secret is used to derive an AES-256-CBC encryption key for sensitive metadata (user ID and workspace ID) embedded within JWT tokens. An attacker with local access or knowledge of the default configuration can decrypt the 'meta' field in JWTs to extract or manipulate internal identifiers. While the JWT signature remains separate, this flaw facilitates internal identifier leakage and potential privilege escalation. The issue is addressed in version 3.1.0 by requiring a strong, user-defined secret.
Affected products
- FlowiseAI flowise <= 3.0.13
Timeline
- 2026-04-15: disclosed
- 2026-04-16: advisory
- 2026-04-16: patched: Version 3.1.0 released
References
- https://api.github.com/users/kolega-ai-dev
- https://github.com/kolega-ai-dev
- https://api.github.com/users/kolega-ai-dev/gists%7B/gist_id%7D
- https://api.github.com/users/kolega-ai-dev/repos
- https://avatars.githubusercontent.com/u/250560052?v=4
- https://api.github.com/users/kolega-ai-dev/events%7B/privacy%7D