CVE-2026-56268

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.2

Description An information disclosure issue exists in the '/api/v1/chatflows/apikey/:apikey' endpoint. When the keyonly query parameter is omitted, the system returns chatflows bound to the provided API key as well as all chatflows across every workspace that have no API key assigned. This occurs because the underlying query lacks a workspace filter, breaking workspace isolation.

An attacker with a valid API key for one workspace can retrieve the full configuration of unprotected chatflows from other workspaces. This exposed data includes flowData (containing system prompts and node configurations), chatbotConfig, apiConfig, and credential IDs within textToSpeech and speechToText fields.

Recommendations Update to version 3.1.2 or later. As a temporary workaround, avoid using the '/api/v1/chatflows/apikey/:apikey' endpoint without the keyonly parameter.