CVE-2026-73604

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description An incomplete credential redaction issue exists where the 'GET /api/v1/credentials/:id' endpoint returns decrypted secrets in plaintext. Authenticated users possessing the credentials:view permission can retrieve sensitive information, such as API keys, cloud service account JSON containing private keys, and database connection URLs with embedded passwords.

Recommendations Update to version 3.1.3 or later. Restrict the credentials:view permission to only trusted administrators to minimize the risk of unauthorized data retrieval.