# CVE-2026-73604: Flowise incomplete credential redaction in API

Source: https://junglewise.ai/threats/cve-2026-73604-flowise-incomplete-credential-redaction-in-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73604 · Severity: medium · CVSS 6.5 · Published 2026-08-13

Flowise, a low-code platform for building AI workflows, has a vulnerability in its credential management API that exposes stored secrets in plaintext. When authenticated users retrieve stored credentials (such as database passwords, API keys, and cloud service account files) via the GET /api/v1/credentials API endpoint, sensitive data stored in string-type fields bypasses the redaction filter and is returned unmasked, allowing any user with credentials:view permission to access production secrets like MongoDB passwords, AWS keys, and Google service account private keys.

Technologies: [flowise (npm)](https://junglewise.ai/threats/technologies/flowise). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73604 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73604 being exploited in the wild.

**How severe is CVE-2026-73604?** Medium severity, with a CVSS score of 6.5, published 13 August 2026.

**Which products and versions are affected?** flowise (npm) SEMVER:introduced=0,fixed=3.1.3.

**Is there a fix for CVE-2026-73604?** Yes. flowise (npm): upgrade to 3.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73604 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73604?** Check whether you run flowise (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- flowise (npm): upgrade to 3.1.3 or later

  ```sh
  npm install flowise@3.1.3
  ```


## Technical details

The vulnerability is an incomplete credential redaction flaw in the credential retrieval endpoint. The GET /api/v1/credentials/:id endpoint decrypts stored credential data and returns it in the plainDataObj response field. While a redactCredentialWithPasswordType() function exists to mask sensitive fields, it only redacts fields explicitly typed as 'password' in the component schema. Many credential types store secrets in fields defined as type: 'string' (e.g., MongoDB connection URLs with embedded passwords, Google service account JSON with RSA private keys, AWS access keys, PostgreSQL URLs), which are returned in plaintext without any masking. An authenticated attacker with credentials:view permission can retrieve the raw unencrypted secrets of any credential in the workspace. The patch (version 3.1.3+) extends redaction to cover all sensitive credential fields regardless of their schema type.

## Affected products

- FlowiseAI Flowise <= 3.1.2

## Identifiers

- CVE-2026-73604
- GHSA-rwrp-9823-p2xq

## Timeline

- 2026-07-27: disclosed
- 2026-08-04: advisory
- 2026-08-05: patched: Fixed in version 3.1.3

## References

- [https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq)
- [https://github.com/FlowiseAI/Flowise](https://github.com/FlowiseAI/Flowise)

## Related threats

- [Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)](https://junglewise.ai/threats/duplicate-advisory-invited-users-auto-promoted-via-sso-email-match-d290aa10)
- [Duplicate Advisory: Flowise contains an unauthenticated sandbox escape](https://junglewise.ai/threats/duplicate-advisory-flowise-contains-an-unauthenticated-sandbox-escape-8959e167)
- [Flowise text-to-speech endpoint credential abuse via unauthenticated access](https://junglewise.ai/threats/cve-2026-73603-flowise-text-to-speech-endpoint-credential-abuse-via)
- [Flowise IDOR in payment source endpoint](https://junglewise.ai/threats/cve-2026-73488-flowise-idor-in-payment-source-endpoint)
- [Flowise CSV and Airtable Agent prompt injection to RCE](https://junglewise.ai/threats/cve-2026-73487-flowise-csv-and-airtable-agent-prompt-injection-to-rce)