CVE-2026-41278: Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GET /api/v1/public-chatflows/:id endpoint returns the full chatflow object without sanitization for public chatflows. Docker validation revealed this is worse than initially assessed: the sanitizeFlowDataForPublicEndpoint function does NOT exist in the released v3.0.13 Docker image. Both public-chatflows AND public-chatbotConfig return completely raw flowData including credential IDs, plaintext API keys, and password-type fields. This vulnerability is fixed in 3.1.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41278?
CVE-2026-41278 has been classified as a high severity vulnerability due to the potential exposure of sensitive data.
How do I fix CVE-2026-41278?
To fix CVE-2026-41278, upgrade Flowise to version 3.1.0 or later to ensure that the API no longer exposes sensitive information.
What data is exposed in CVE-2026-41278?
CVE-2026-41278 exposes unsanitized flowData which may include plaintext API keys, passwords, and credential IDs.
Which versions of Flowise are affected by CVE-2026-41278?
CVE-2026-41278 affects all versions of Flowise prior to 3.1.0.
What actions should I take if I am using an affected version of Flowise?
If you are using an affected version of Flowise, immediately upgrade to version 3.1.0 or later to mitigate the security risk.