CVE-2026-56269: Flowise Information Disclosure Flaw

CVE-2026-56269 Overview

CVE-2026-56269 affects Flowise versions prior to 3.1.0, including the npm package flowise at versions 3.0.13 and earlier. The application uses a weak hardcoded default value Secre$t for the TOKEN_HASH_SECRET environment variable in packages/server/src/enterprise/utils/tempTokenUtils.ts when the variable is not configured. This secret derives the AES-256-CBC key used to encrypt user IDs and workspace IDs in the meta field of JWT tokens. The weakness falls under [CWE-798] Use of Hard-coded Credentials.

Critical Impact
An attacker aware of the default secret can decrypt JWT meta fields to extract internal user and workspace identifiers, and re-encrypt manipulated values that may aid privilege escalation or unauthorized data access.

Affected Products

Flowise versions prior to 3.1.0
npm package flowise versions 3.0.13 and earlier
Flowise Enterprise deployments using default TOKEN_HASH_SECRET

Discovery Timeline

2026-06-24 - CVE-2026-56269 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56269

Vulnerability Analysis

The vulnerability resides in the temporary token utility module packages/server/src/enterprise/utils/tempTokenUtils.ts. When operators do not configure the TOKEN_HASH_SECRET environment variable, Flowise falls back to the hardcoded string Secre$t. The application derives the AES-256-CBC encryption key from this secret. That key encrypts the meta field embedded in JWT tokens, which stores internal user IDs and workspace IDs.

Because the secret is publicly visible in the source repository, any attacker can reproduce the key derivation. They can then decrypt the meta field of any JWT issued by a deployment running on default settings. The same key can re-encrypt attacker-chosen values, producing a valid ciphertext blob.

The JWT signature itself is validated through a separate signing key, so tampered meta ciphertext does not directly forge a session. However, exposure of internal identifiers and the ability to substitute encrypted metadata can support downstream privilege escalation or unauthorized data lookups when other components trust the decrypted contents.

Root Cause

The root cause is the inclusion of a static fallback secret in source code, classified as [CWE-798]. Treating a non-configured TOKEN_HASH_SECRET as a recoverable condition rather than a fatal startup error removes the cryptographic strength of the meta field.

Attack Vector

Exploitation requires local access conditions and high privileges to interact with valid tokens issued by the target instance. An attacker who obtains any JWT from the deployment can decrypt the meta field offline using the known default key, harvest user and workspace identifiers, and craft replacement ciphertext for use in follow-on requests where the metadata is consumed.

The vulnerability mechanism is documented in the Flowise GitHub Security Advisory GHSA-m7mq-85xj-9x33 and the VulnCheck Advisory.

Detection Methods for CVE-2026-56269

Indicators of Compromise

JWT tokens whose meta ciphertext decrypts successfully using a key derived from the string Secre$t.
Application logs showing requests with altered workspace or user identifiers that do not match the authenticated principal.
Deployments where the TOKEN_HASH_SECRET environment variable is unset or empty at process startup.

Detection Strategies

Audit running Flowise processes and container manifests to confirm whether TOKEN_HASH_SECRET is defined and not equal to Secre$t.
Inspect issued JWTs and verify that the encrypted meta field cannot be decrypted with the known default key.
Compare installed flowise npm package versions against the fixed release line >= 3.1.0.

Monitoring Recommendations

Alert on Flowise startup events that do not log a configured TOKEN_HASH_SECRET.
Monitor authentication and workspace access logs for identifier mismatches between session subjects and resource owners.
Track outbound enumeration patterns against user and workspace API endpoints following token reuse.

How to Mitigate CVE-2026-56269

Immediate Actions Required

Upgrade Flowise to version 3.1.0 or later across all server and container deployments.
Set a strong, unique value for the TOKEN_HASH_SECRET environment variable before restarting the service.
Invalidate all existing JWT tokens and force users to re-authenticate after rotation.

Patch Information

The Flowise maintainers released a fix in version 3.1.0. The remediation is described in the Flowise GitHub Security Advisory GHSA-m7mq-85xj-9x33. Operators should pull the corresponding npm package flowise@3.1.0 or newer and redeploy.

Workarounds

Override the default by exporting TOKEN_HASH_SECRET to a high-entropy value generated from a cryptographically secure source.
Restrict network exposure of the Flowise management interface to trusted operators while the upgrade is staged.
Rotate signing material and any derived workspace tokens after applying the new secret.

bash

# Configuration example
export TOKEN_HASH_SECRET="$(openssl rand -base64 48)"
npm install -g flowise@3.1.0
pm2 restart flowise