CVE-2026-56269

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description The software uses a weak hardcoded default value 'Secre$t' for the TOKEN HASH SECRET environment variable in the packages/server/src/enterprise/utils/tempTokenUtils.ts file when the variable is not configured. This secret is used to derive an AES-256-CBC (Advanced Encryption Standard with Cipher Block Chaining) key to encrypt user IDs and workspace IDs within the 'meta' field of JWT (JSON Web Tokens). An attacker aware of the default secret can decrypt this metadata to extract internal identifiers or re-encrypt manipulated values. While the JWT signature is validated separately, the disclosure and manipulation of this metadata could facilitate unauthorized data access or privilege escalation.

Recommendations Update to version 3.1.0 or later. Configure the TOKEN HASH SECRET environment variable with a strong, random value containing at least 32 bytes of entropy.