CVE-2026-41266: Flowise: Sensitive Data Leak in public-chatbotConfig
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration without any authentication. An attacker with knowledge just of a chatflow UUID can retrieve credentials stored in password type fields and HTTP headers, leading to credential theft and more. This vulnerability is fixed in 3.1.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41266?
CVE-2026-41266 has been classified as a high-severity vulnerability due to its potential to expose sensitive data.
How do I fix CVE-2026-41266?
To fix CVE-2026-41266, upgrade Flowise to version 3.1.0 or later, which resolves the sensitive data leak.
What type of sensitive data is leaked in CVE-2026-41266?
CVE-2026-41266 exposes sensitive data including API keys, HTTP authorization headers, and internal configuration.
Which versions of Flowise are affected by CVE-2026-41266?
CVE-2026-41266 affects all versions of Flowise prior to 3.1.0.
Is there a public exploit available for CVE-2026-41266?
There are no specific public exploits reported for CVE-2026-41266, but the vulnerability's potential impact is significant.