Executive brief
Flowise, an open-source tool for building LLM applications, was found to use a weak default setting for password security. Specifically, it uses a low number of 'salt rounds' when hashing passwords, which makes it significantly easier for attackers to crack user passwords if they gain access to the database. This could lead to unauthorized access to user accounts and sensitive data following a data breach.
Technical details
Flowise uses the bcrypt algorithm with a default of 5 salt rounds (2^5 = 32 iterations) for password hashing, which is significantly below the industry-standard recommendation of at least 10 rounds. This cryptographic weakness resides in the `getHash` function within `encryption.util.ts`. While the value is configurable via the `PASSWORD_SALT_HASH_ROUNDS` environment variable, the low default value means most deployments are vulnerable to high-speed offline brute-force attacks. An attacker with access to the database could crack these hashes approximately 30 times faster than if the recommended 10 rounds were used. The issue is addressed in version 3.0.13.
Affected products
- FlowiseAI flowise <= 3.0.12
Timeline
- 2026-03-05: disclosed
- 2026-03-05: advisory
- 2026-03-05: patched: Fixed in version 3.0.13
References
- https://api.github.com/users/kolega-ai-dev
- https://github.com/kolega-ai-dev
- https://api.github.com/users/kolega-ai-dev/gists%7B/gist_id%7D
- https://api.github.com/users/kolega-ai-dev/repos
- https://avatars.githubusercontent.com/u/250560052?v=4
- https://api.github.com/users/kolega-ai-dev/events%7B/privacy%7D