CVE-2026-56268: Flowise Information Disclosure Flaw

CVE-2026-56268 Overview

CVE-2026-56268 is an information disclosure vulnerability in Flowise versions before 3.1.2. The flaw resides in the /api/v1/chatflows/apikey/:apikey endpoint, which fails to apply a workspace filter when the keyonly query parameter is omitted. An authenticated attacker holding a valid API key for one workspace can retrieve every chatflow across all workspaces that has no API key assigned. Exposed data includes flowData with system prompts and node configurations, chatbotConfig, apiConfig, and credential IDs. The issue is tracked under CWE-863: Incorrect Authorization.

Critical Impact
A low-privileged API consumer in one Flowise workspace can read sensitive chatflow configurations belonging to other workspaces, breaking tenant isolation.

Affected Products

Flowise (flowiseai/flowise) versions prior to 3.1.2
Self-hosted Flowise deployments exposing the /api/v1/chatflows/apikey/:apikey endpoint
Multi-workspace Flowise installations with API key authentication enabled

Discovery Timeline

2026-06-22 - CVE-2026-56268 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56268

Vulnerability Analysis

Flowise exposes the /api/v1/chatflows/apikey/:apikey endpoint so clients can list chatflows associated with a given API key. The endpoint accepts an optional keyonly query parameter that controls result scoping. When keyonly is omitted, which is the default, the backend query returns every chatflow whose apikeyid matches the supplied key, plus every chatflow with no API key assigned across all workspaces. The query never constrains results to the requester's workspace, breaking the tenancy boundary enforced elsewhere in the application.

An attacker who possesses any valid API key issued in any workspace can call this endpoint and enumerate unprotected chatflows from foreign workspaces. The returned objects include the complete flowData definition, which contains system prompts, model parameters, and node configurations, along with chatbotConfig, apiConfig, and credential references. While the credential secrets themselves are not directly exposed, the credential IDs and prompt content provide significant reconnaissance value and may reveal proprietary AI logic.

Root Cause

The defect is an authorization flaw classified as [CWE-863]. The database query backing the endpoint filters on the supplied API key but lacks a WHERE workspaceId = ? clause. Chatflows lacking an apikeyid value are treated as globally visible rather than scoped to their owning workspace.

Attack Vector

Exploitation requires only network access to the Flowise API and a single valid API key. The attacker issues an HTTP GET request to /api/v1/chatflows/apikey/<their_apikey> without specifying keyonly=true. The response includes every chatflow without an assigned API key from every workspace. No additional privilege escalation, user interaction, or authentication chaining is required. See the GitHub Security Advisory GHSA-c2c9-mfw7-p8hw and the VulnCheck Advisory on Flowise for the technical write-up.

Detection Methods for CVE-2026-56268

Indicators of Compromise

Access log entries showing GET requests to /api/v1/chatflows/apikey/:apikey without the keyonly=true query parameter
Unusual volumes of chatflow read operations originating from a single API key within a short window
API key activity returning chatflow IDs that do not belong to the key's owning workspace

Detection Strategies

Inspect HTTP access logs and reverse-proxy telemetry for any requests matching the vulnerable endpoint pattern issued by Flowise versions prior to 3.1.2
Correlate API key identifiers against the workspace IDs returned in response payloads to flag cross-workspace data retrieval
Baseline normal chatflow enumeration behavior per API key, then alert on deviations such as bulk listing or off-hours access

Monitoring Recommendations

Forward Flowise application logs and reverse-proxy logs to a centralized log platform for retention and search
Enable audit logging on Flowise API endpoints and retain logs long enough to support retrospective investigation
Monitor outbound traffic from the Flowise host for unexpected exfiltration of flowData or credential identifiers

How to Mitigate CVE-2026-56268

Immediate Actions Required

Upgrade Flowise to version 3.1.2 or later, which adds the missing workspace filter to the chatflows endpoint
Rotate any API keys that may have been used to query the vulnerable endpoint and review chatflow access logs
Audit existing chatflows for sensitive system prompts or credential references and assign API keys to any chatflow currently lacking one

Patch Information

The vendor fix is included in Flowise 3.1.2. Refer to the GitHub Security Advisory GHSA-c2c9-mfw7-p8hw for the patch commit and upgrade instructions. Operators running self-hosted Flowise should pull the patched container image or rebuild from the tagged release.

Workarounds

Restrict network access to the Flowise API so that only trusted clients can reach /api/v1/chatflows/apikey/:apikey
Require keyonly=true at the reverse-proxy layer by rewriting requests to the vulnerable endpoint until the patch is deployed
Assign an API key to every chatflow so no chatflow falls into the unprotected, cross-workspace-visible bucket

bash

# Example nginx rule to force keyonly=true on the vulnerable endpoint
location ~ ^/api/v1/chatflows/apikey/ {
    if ($arg_keyonly != "true") {
        return 403;
    }
    proxy_pass http://flowise_backend;
}