CVE-2026-56272

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.13

Description The software uses bcrypt with a default salt round value of 5, resulting in only 32 iterations. This is significantly lower than the OWASP-recommended minimum of 10 rounds (1024 iterations). This cryptographic weakness allows attackers using modern GPU hardware to crack password hashes approximately 30 times faster in the event of a database breach, potentially compromising all user accounts. The issue is present in the getHash() function and the resetPassword process.

Recommendations Update to version 3.0.13 or later. Increase the PASSWORD SALT HASH ROUNDS environment variable to at least 10, or 12 for a better security-performance balance.