https://vulnerability.circl.lu/sightings/feed 2026-08-28T07:44:43.043428+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/3d1b3ccb-6deb-439f-a030-57c561d99b24/export 2026-08-28T07:44:43.055181+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3d1b3ccb-6deb-439f-a030-57c561d99b24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RWRP-9823-P2XQ", "type": "seen", "source": "https://gist.github.com/alon710/f760ad982633274fcad75b35ba6ece57", "content": "# GHSA-RWRP-9823-P2XQ: GHSA-RWRP-9823-P2XQ: Incomplete Credential Redaction in Flowise API\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/GHSA-RWRP-9823-P2XQ\n\n## Summary\nAn incomplete credential redaction mechanism in Flowise allows authenticated users with standard view permissions to retrieve sensitive decrypted third-party credentials in plaintext.\n\n## TL;DR\nFlowise fails to redact decrypted credentials whose fields are defined as 'string' instead of 'password' in the schema, exposing database passwords and GCP private keys over the API.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network\n- **CVSS Score**: 6.5\n- **EPSS Score**: N/A\n- **Impact**: Information Exposure\n- **Exploit Status**: PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Flowise deployments utilizing visual LLM orchestration workflows and database credentials\n- **Flowise**: <= 3.1.2 (Fixed in: `3.1.3`)\n\n## Mitigation\n\n- Upgrade Flowise deployment to v3.1.3 or later\n- Network-segment the Flowise server and enforce least privilege controls on databases\n- Audit user access and assign minimum necessary view permissions\n\n**Remediation Steps:**\n1. Pull the latest secure Flowise Docker image or update npm dependencies to v3.1.3\n2. Re-launch the application with updated dependencies\n3. Verify API endpoints no longer return unredacted string types in plainDataObj\n\n## References\n\n- [GitHub Security Advisory GHSA-RWRP-9823-P2XQ](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rwrp-9823-p2xq)\n- [Global Advisory Record](https://github.com/advisories/GHSA-RWRP-9823-P2XQ)\n- [Flowise Release tag 3.1.3](https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3)\n- [Flowise GitHub Codebase](https://github.com/FlowiseAI/Flowise)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-RWRP-9823-P2XQ) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T18:31:34.464822Z"} 2026-08-04T18:31:34.464822+00:00