CVE-2026-56269: Flowise - Weak Default Token Hash Secret in JWT Token Encryption
Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKENHASHSECRET environment variable in packages/server/src/enterprise/utils/tempTokenUtils.ts when the variable is not configured. This secret derives the AES-256-CBC key used to encrypt user IDs and workspace IDs in the 'meta' field of JWT tokens. An attacker who knows the default secret can decrypt this metadata to extract internal user and workspace identifiers, and re-encrypt manipulated values such as altered user or workspace IDs. Because the JWT signature is validated separately, decrypting or tampering with this metadata does not by itself grant access, but the disclosure of internal identifiers and possible metadata manipulation could aid privilege escalation or unauthorized data access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm package flowiseto a version that resolves this vulnerability.Fixed in 3.1.0 - Configuration
Set the TOKEN_HASH_SECRET environment variable to a strong, unique value so Flowise does not fall back to the weak hardcoded default 'Secre$t' used for AES-256-CBC encryption of JWT meta fields (user IDs/workspace IDs).
Flowise (packages/server/src/enterprise/utils/tempTokenUtils.ts) TOKEN_HASH_SECRET = configured to a strong, non-default secret (avoid the weak default 'Secre$t') - Operational
After changing TOKEN_HASH_SECRET and applying the upgrade to 3.1.0, invalidate/refresh any existing JWT tokens that may contain encrypted metadata derived from the old (default) secret.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56269?
The severity of CVE-2026-56269 is medium with a score of 4.6.
How do I fix CVE-2026-56269?
To fix CVE-2026-56269, configure the TOKEN_HASH_SECRET environment variable with a strong, custom secret before using the software.
What impact does CVE-2026-56269 have on security?
CVE-2026-56269 could lead to weakened security in JWT token encryption due to the use of a weak default secret.
Which versions of Flowise are affected by CVE-2026-56269?
CVE-2026-56269 affects Flowise versions 3.0.13 and earlier.
Can CVE-2026-56269 lead to unauthorized access?
Yes, the weak default token hash secret can potentially allow unauthorized access if not properly configured.