CVE-2026-41266

Flowise: Sensitive Data Leak in public-chatbotConfig

State: Published
Severity: 7.7 High
Published: Apr 23, 2026
Updated: Apr 25, 2026
Reserved: Apr 18, 2026

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration without any authentication. An attacker with knowledge just of a chatflow UUID can retrieve credentials stored in password type fields and HTTP headers, leading to credential theft and more. This vulnerability is fixed in 3.1.0.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-522 Insufficiently Protected Credentials
CWE-862 Missing Authorization

Affected Products

Product	Versions
FlowiseFlowiseAI	< 3.1.0Affected

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4jpm-cgx2-8h37

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.