CVE-2026-46443: Flowise Information Disclosure Flaw

CVE-2026-46443 Overview

CVE-2026-46443 is an information disclosure vulnerability in Flowise, a drag-and-drop interface for building large language model (LLM) workflows. Versions prior to 3.1.2 fail to strip the encryptedData field from credential responses when the API is queried with a credentialName filter parameter. The unfiltered code path correctly omits this field, but the filtered code path returns encrypted credential material to any authenticated caller. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated users can retrieve encrypted credential blobs for stored integrations through the credential lookup API, exposing secrets used by LLM-driven workflows.

Affected Products

Flowise versions prior to 3.1.2
FlowiseAI deployments exposing the credentials API
LLM workflows storing third-party API keys in Flowise

Discovery Timeline

2026-06-08 - CVE-2026-46443 published to NVD
2026-06-11 - Last updated in NVD database

Technical Details for CVE-2026-46443

Vulnerability Analysis

Flowise exposes a credentials API used to retrieve stored secrets for downstream LLM integrations. The handler implements two retrieval paths: one without a filter, returning all credentials, and one filtered by the credentialName query parameter. The unfiltered path explicitly omits the encryptedData field before serializing the response. The filtered path skips this projection, returning the full database record including encryptedData.

Any authenticated caller with access to the credentials endpoint can therefore retrieve encrypted credential material by simply supplying a credentialName filter. While the data is encrypted at rest, exposing it broadens the attack surface: an attacker who later obtains the encryption key, the host file system, or the application secret can decrypt the recovered blobs offline.

The issue is patched in Flowise 3.1.2, which applies the same field-stripping logic to both code paths.

Root Cause

The root cause is inconsistent output filtering between two branches of the credential retrieval handler. The unfiltered branch enforces a response projection that excludes encryptedData, while the credentialName-filtered branch returns the raw entity. This is a classic [CWE-200] information exposure caused by missing field sanitization on a conditional code path.

Attack Vector

The vulnerability is reachable over the network by an authenticated user with low privileges. The attacker issues a GET request to the credentials endpoint and supplies a credentialName query parameter matching a stored credential. The response contains the encryptedData field that the API contract is intended to suppress. No user interaction is required, and the attack does not modify server state.

Flowise commonly stores credentials for OpenAI, Anthropic, vector databases, and other third-party services. Recovered ciphertext becomes a high-value target for offline cryptanalysis or chained attacks against the host. See the GitHub Security Advisory GHSA-7g73-99r4-m4mj for vendor details.

Detection Methods for CVE-2026-46443

Indicators of Compromise

HTTP GET requests to the Flowise credentials API containing a credentialName query parameter from non-administrative accounts.
Response payloads from the credentials endpoint containing an encryptedData JSON field.
Unexpected enumeration of credential names followed by targeted filtered lookups in short succession.

Detection Strategies

Inspect reverse proxy or application logs for requests matching GET /api/v1/credentials?credentialName= and flag responses with bodies larger than the expected metadata-only size.
Correlate credential API access with the authenticated user identity to identify accounts retrieving credentials they do not own.
Compare Flowise version strings reported by the /api/v1/version endpoint against 3.1.2 to identify unpatched hosts.

Monitoring Recommendations

Forward Flowise application and access logs to a centralized log platform and alert on credentialName query usage.
Track outbound API calls from systems that share credentials with Flowise to detect downstream abuse of leaked secrets.
Audit Flowise user accounts and API tokens monthly, removing any that no longer require credential access.

How to Mitigate CVE-2026-46443

Immediate Actions Required

Upgrade Flowise to version 3.1.2 or later using the artifacts listed in the Flowise 3.1.2 release notes.
Rotate every credential stored in Flowise, including LLM provider API keys, database credentials, and webhook secrets.
Review access logs since deployment for requests using the credentialName filter and treat matching credentials as exposed.

Patch Information

Flowise 3.1.2 enforces the encryptedData field stripping on the filtered credential lookup path. The fix and full advisory are documented in GHSA-7g73-99r4-m4mj. After upgrading, restart the Flowise service and verify the running version through the admin console or /api/v1/version endpoint.

Workarounds

Restrict network access to the Flowise credentials API to a trusted administrative network segment until the patch is applied.
Place Flowise behind a reverse proxy that blocks requests containing the credentialName query parameter for non-admin users.
Reduce the privileges of Flowise application accounts so that only required users can call the credentials endpoint.

bash

# Example nginx rule to block the vulnerable filter until patched
location /api/v1/credentials {
    if ($arg_credentialName) {
        return 403;
    }
    proxy_pass http://flowise_backend;
}