CVE-2026-56272: Flowise Weak Password Hashing Vulnerability

CVE-2026-56272 Overview

CVE-2026-56272 affects Flowise versions before 3.0.13. The application uses the bcrypt password hashing function with a default work factor of 5 salt rounds. This setting produces only 32 iterations per hash, far below the OWASP-recommended minimum of 10 rounds. The reduced work factor weakens stored password hashes against offline cracking attempts. An attacker who obtains the user database can recover plaintext passwords roughly 30 times faster using modern GPU hardware than against properly configured bcrypt hashes. This weakness maps to CWE-916, Use of Password Hash With Insufficient Computational Effort.

Critical Impact
Attackers with database access can crack Flowise user password hashes approximately 30 times faster than against bcrypt configured at the OWASP-recommended work factor, exposing all stored credentials.

Affected Products

Flowise versions prior to 3.0.13
FlowiseAI self-hosted deployments using default bcrypt configuration
Any Flowise instance storing user account credentials in the local database

Discovery Timeline

2026-06-24 - CVE-2026-56272 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56272

Vulnerability Analysis

Flowise is an open-source low-code platform for building large language model (LLM) applications. The platform stores authenticated user credentials as bcrypt hashes in its backend database. Prior to version 3.0.13, the codebase invokes bcrypt with a saltRounds parameter of 5.

The bcrypt cost factor is exponential. A value of 5 produces 2^5, or 32, key derivation iterations. OWASP guidance specifies a minimum of 10 rounds, equating to 1,024 iterations. The shipped configuration therefore performs 32 times less work per hash than the recommended baseline. Modern GPU and ASIC cracking rigs can leverage this gap to brute-force common passwords and dictionary candidates at roughly 30 times the throughput achievable against properly tuned bcrypt hashes.

The vulnerability does not enable direct authentication bypass or remote code execution. It functions as a force multiplier in post-compromise scenarios where an attacker has already obtained the password hash store through SQL injection, backup exfiltration, insider access, or a separate breach.

Root Cause

The root cause is an insecure default configuration in the password hashing routine. The developer-supplied saltRounds value of 5 was lower than the OWASP Password Storage Cheat Sheet minimum. No runtime check enforced a stronger work factor, and existing user hashes were generated with the weak setting.

Attack Vector

Exploitation requires that an attacker first acquire the bcrypt hash material from the Flowise database. The attack vector is local with high attack complexity and high privileges, reflecting the prerequisite that the hash store must already be exposed. Once the hashes are obtained, the attacker performs offline brute-force or dictionary attacks using GPU-accelerated tools such as hashcat mode 3200. The reduced iteration count allows substantially more candidate guesses per second, raising the probability of recovering weak or reused passwords.

The vulnerability mechanism is described in prose because no verified exploitation code is published. Technical context is available in the GitHub Security Advisory GHSA-x2g5-fvc2-gqvp and the VulnCheck Advisory.

Detection Methods for CVE-2026-56272

Indicators of Compromise

Bcrypt hashes in the Flowise user table beginning with the prefix $2a$05$ or $2b$05$, indicating the 5-round work factor
Unexpected read access against the Flowise database tables containing user credentials
Outbound transfer of database dumps or backup archives from the Flowise host
Successful authentication events from unfamiliar source addresses against previously inactive accounts

Detection Strategies

Audit Flowise database storage to identify password hashes generated with saltRounds below 10
Review application source or container images for calls to bcrypt.hash or bcrypt.hashSync using a cost parameter below 10
Correlate database access logs with administrative activity to identify unauthorized hash extraction
Monitor authentication endpoints for distributed credential-stuffing patterns following any suspected database exposure

Monitoring Recommendations

Enable verbose audit logging on the Flowise backend database and forward events to a centralized analytics platform
Alert on bulk read operations against the users table or on direct queries returning hash columns
Track failed and successful login attempts per account and per source IP to identify credential-validation activity

How to Mitigate CVE-2026-56272

Immediate Actions Required

Upgrade Flowise to version 3.0.13 or later, which raises the bcrypt work factor to the recommended minimum
Force a password reset for every existing Flowise user account so credentials are rehashed with the stronger cost factor
Restrict network and filesystem access to the Flowise database to administrative principals only
Review historical access logs for signs that the user table has already been read or exported

Patch Information

The maintainers addressed the issue in Flowise 3.0.13 by increasing the bcrypt salt rounds to meet OWASP guidance. Operators should deploy this release and ensure that all hashes stored prior to the upgrade are regenerated through a password reset workflow. Patch details are documented in GitHub Security Advisory GHSA-x2g5-fvc2-gqvp.

Workarounds

If immediate upgrade is not possible, modify the application configuration to invoke bcrypt with at least 10 salt rounds and rehash credentials on next successful login
Place the Flowise instance behind a reverse proxy that enforces multi-factor authentication to reduce the value of any recovered password
Isolate the Flowise database on a private network segment with strict egress filtering to limit exfiltration paths

bash

# Configuration example: enforce OWASP-recommended bcrypt work factor
# Set the environment variable before starting Flowise 3.0.13 or later
export BCRYPT_SALT_ROUNDS=12
npm start