CVE-2026-56272: Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing
Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware, potentially compromising all user accounts in a database breach scenario.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56272?
The severity of CVE-2026-56272 is medium with a score of 4.1.
How do I fix CVE-2026-56272?
To fix CVE-2026-56272, update Flowise to version 3.0.13 or later, where the bcrypt salt rounds have been increased.
What impact does CVE-2026-56272 have on user data?
CVE-2026-56272 allows attackers to crack password hashes much faster, potentially compromising all user accounts in the database.
In which versions of Flowise is CVE-2026-56272 present?
CVE-2026-56272 is present in all versions of Flowise prior to 3.0.13.
What hashing algorithm is affected by CVE-2026-56272?
CVE-2026-56272 affects the bcrypt hashing algorithm due to insufficient salt rounds.