CyberRota Analysis
AI-GeneratedFlowise versions prior to 3.1.3 are vulnerable due to an incomplete credential redaction issue in the GET /api/v1/credentials/:id endpoint, which exposes decrypted secrets in plaintext. This flaw allows authenticated users with the credentials:view permission to access sensitive information, including database connection URLs, cloud service account credentials, and API keys. Organizations using Flowise should prioritize patching this vulnerability to protect against potential data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.