GHSA-RWRP-9823-P2XQ: GHSA-RWRP-9823-P2XQ: Incomplete Credential Redaction in Flowise API

GHSA-RWRP-9823-P2XQ: Incomplete Credential Redaction in Flowise API

Vulnerability ID: GHSA-RWRP-9823-P2XQ
CVSS Score: 6.5
Published: 2026-08-04

An incomplete credential redaction mechanism in Flowise allows authenticated users with standard view permissions to retrieve sensitive decrypted third-party credentials in plaintext.

TL;DR

Flowise fails to redact decrypted credentials whose fields are defined as 'string' instead of 'password' in the schema, exposing database passwords and GCP private keys over the API.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-200
• Attack Vector: Network
• CVSS Score: 6.5
• EPSS Score: N/A
• Impact: Information Exposure
• Exploit Status: PoC
• KEV Status: Not Listed

Affected Systems

• Flowise deployments utilizing visual LLM orchestration workflows and database credentials
• Flowise: <= 3.1.2 (Fixed in: 3.1.3)

Exploit Details

• GitHub Security Advisory: Official advisory detailing reproduction steps and proof of concept

Mitigation Strategies

• Upgrade Flowise deployment to v3.1.3 or later
• Network-segment the Flowise server and enforce least privilege controls on databases
• Audit user access and assign minimum necessary view permissions

Remediation Steps:

1. Pull the latest secure Flowise Docker image or update npm dependencies to v3.1.3
2. Re-launch the application with updated dependencies
3. Verify API endpoints no longer return unredacted string types in plainDataObj

References

• GitHub Security Advisory GHSA-RWRP-9823-P2XQ
• Global Advisory Record
• Flowise Release tag 3.1.3
• Flowise GitHub Codebase

---

Read the full report for GHSA-RWRP-9823-P2XQ on our website for more details including interactive diagrams and full exploit analysis.