CVE-2026-73604

Executive Summary

CVE-2026-73604 is an incomplete credential redaction vulnerability in Flowise versions prior to 3.1.3, affecting the GET /api/v1/credentials/:id endpoint. Authenticated users holding the credentials:view permission can retrieve decrypted credentials in plaintext, including database connection URLs with embedded passwords, cloud service account JSON files containing private keys, and API keys. The vulnerability carries a CVSS score of 6.5 (High) with a confidentiality impact of C:H and requires only low-privilege authentication to exploit. At the time of this report, no patch evidence exists from any tracked source, making this an unpatched exposure in affected deployments.

Technical Analysis

Vulnerability Class: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor.

Affected Component: The Flowise REST API endpoint GET /api/v1/credentials/:id is responsible for retrieving credential records stored within the Flowise platform. Flowise is an open-source visual tool for building LLM (large language model) applications that commonly integrates with external services requiring credential storage — databases, cloud providers, and third-party APIs.

Vulnerability Mechanism: The NVD description identifies an "incomplete credential redaction" flaw. In a properly designed credential management system, when a stored credential is retrieved for display or reference purposes, sensitive fields (such as secret keys, private key material, or embedded passwords) should be redacted or masked before being returned to the client. The endpoint in question returns decrypted secrets in plaintext, meaning the server-side serialization logic either:

1. Fails to apply redaction filters to certain credential types (incomplete coverage across credential schemas), or
2. Returns the full decrypted credential object without any field-level sanitization.

The term "incomplete" in the NVD title suggests that redaction logic exists elsewhere in the application but is not consistently applied to all credential types or all fields within a credential record — an inconsistent security control implementation.

Affected Data Types: Based on the NVD description, the following sensitive data is exposed:

• Database connection URLs — Connection strings frequently embed authentication credentials in the URL format (e.g., postgres://user:password@host:5432/db). Retrieving such URLs exposes the credential pair directly.
• Cloud service account JSON — Cloud provider service account keys (e.g., Google Cloud service account JSON) contain a private_key field and often a client_secret. These files grant full programmatic access to cloud resources if leaked.
• API keys — Plaintext API keys for third-party services (OpenAI, Anthropic, Pinecone, etc.) that Flowise agents rely upon.

Attack Surface: The endpoint is network-accessible (AV:N) via the Flowise web application's REST API. Authentication is required (PR:L — low privileges suffice), specifically the credentials:view permission. The credentials:view permission is likely a default or commonly granted permission for users who need to configure or manage Flowise agents, making the vulnerable user population broader than strictly administrative roles.

Technical Relationship to OWASP: This vulnerability aligns with OWASP API Security Top 10 — specifically API3:2023 (Broken Object Property Level Authorization) and API9:2023 (Improper Inventory Management), although the primary classification remains CWE-200. The flaw highlights a common API security anti-pattern where server-side field filtering is inconsistent across object types.

Exploitation Scenarios

Prerequisites: The attacker must possess:

1. Valid authentication credentials for a Flowise account (username/password, API token, or session cookie).
2. The credentials:view permission assigned to their account/role.
3. Network access to the Flowise API endpoint (either directly or via SSRF, if the API is internally segmented).

Scenario 1 — Low-Privilege User Credential Harvesting:

1. Reconnaissance: The attacker logs into the Flowise interface using their legitimate low-privilege account. They enumerate available credentials by issuing a GET request to the credential listing endpoint (likely a sibling endpoint to the affected one, such as /api/v1/credentials), which returns a list of credential resource IDs and their types.
2. Trigger: The attacker iterates through each credential ID by issuing GET /api/v1/credentials/:id requests, replacing :id with each discovered identifier.
3. Payload/Execution: No malicious payload is required — the vulnerability is in the server-side response serialization. The attacker simply issues benign HTTP GET requests to the endpoint. The server responds with the full decrypted credential object in plaintext.
4. Post-Exploitation: The attacker obtains database passwords, cloud private keys, and API keys. They can then pivot to external systems: connect directly to the victim's database, authenticate to cloud consoles, or exfiltrate data via third-party APIs. The confidentiality impact is rated High (C:H) per CVSS.

Scenario 2 — Insider Threat / Privilege Escalation Path:

1. Reconnaissance: A malicious insider with credentials:view permission (e.g., a contractor, a developer with limited access, a support user) navigates the Flowise UI.
2. Trigger: The attacker calls the affected endpoint for a credential entry they are not meant to see in plaintext — e.g., a production database credential or a cloud service account intended for use by a different team.
3. Execution: The endpoint returns the raw credential payload, bypassing any intended organizational separation of secrets.
4. Impact: The attacker uses the exposed cloud service account JSON to access cloud resources (compute instances, storage buckets, secrets managers), potentially escalating to full cloud compromise.

Scenario 3 — Session Hijacking / API Token Abuse:

1. Reconnaissance: An attacker obtains a valid session token (via phishing, token leakage in logs, or a prior lower-severity vulnerability) for a user with credentials:view permissions.
2. Trigger: Using the stolen token, the attacker directly calls GET /api/v1/credentials/:id for all credential IDs they can enumerate.
3. Execution: No further exploitation needed; the response contains the required secrets.
4. Impact: The attacker pivots to any external system whose credentials were exposed — rendering the credentials themselves the weapon for lateral movement.

Attack Chain Summary:

Authentication (valid low-privilege account)
  → Enumerate credential IDs
  → GET /api/v1/credentials/:id
  → Plaintext decrypted secrets in response
  → Pivot to external systems (DB, Cloud, APIs)

Current Exploit Status: No public PoC or exploit code is available (POC_STATUS: Private). No Nuclei template exists. The attack chain above is inferred strictly from the vulnerability class and endpoint description. Attackers with knowledge of Flowise's API structure can trivially exploit this, however, as no special technique beyond standard API enumeration is required.

Impact Assessment

CVSS Breakdown (per published vector):

• Base Score: 6.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network — exploited remotely via HTTP requests.
• Attack Complexity: Low — no special conditions or race conditions required.
• Privileges Required: Low — any authenticated user with credentials:view.
• User Interaction: None — no victim interaction required.
• Confidentiality Impact: High — complete or partial disclosure of all credential material stored in Flowise.
• Integrity Impact: None — the vulnerability does not permit data modification within Flowise itself.
• Availability Impact: None — no denial of service induced.

Business Impact: The CVSS score of 6.5 understates the real-world business risk. While the direct impact on the Flowise application itself is confined to confidentiality, the blast radius extends to every external system whose credentials are stored within Flowise:

• Database compromise: Connection URLs with embedded credentials grant direct database access, enabling data exfiltration, ransomware deployment, or data destruction.
• Cloud account takeover: Service account JSON contains private keys. An attacker with a cloud service account private key can authenticate as that service account, access cloud storage, compute, or secrets, and potentially escalate privileges within the cloud environment.
• Third-party API abuse: Exposed API keys (LLM providers, CRM, etc.) enable financial fraud (especially for metered LLM APIs where costs accrue per token), data exfiltration, or impersonation.

Affected Systems: All Flowise deployments running version < 3.1.3. Given Flowise's popularity for LLM application prototyping, affected deployments likely exist across startups, enterprise AI labs, and data science teams. Self-hosted instances are most at risk; cloud-hosted Flowise services may have mitigated the issue if their provider patches promptly.

EPSS / Exploitability: EPSS has not yet been scored by FIRST.org. However, given the trivial exploitation mechanism (simple authenticated GET requests), the vulnerability is highly likely to be incorporated into automated scanning tools. Organizations should treat the exposure as actively exploitable even without public evidence.

CISA KEV: Not listed on the CISA Known Exploited Vulnerabilities catalog at the time of writing.

Data Sensitivity: The credential material exposed is among the most sensitive data classes in any organization — it represents the keys to the kingdom for subsequent intrusion and data breach scenarios.

Detection Guidance

The following detection rules assume monitoring of the Flowise API and HTTP traffic. Adjust field mappings to match your environment's log schema.

Sigma Rule

title: Flowise Credential Exfiltration via GET /api/v1/credentials/:id
id: 2b4d3f0a-5c38-4a8e-9f5b-a01f7d9e2c1b
status: experimental
description: Detects repeated GET requests to the Flowise credentials endpoint which may indicate enumeration and exfiltration of plaintext credentials (CVE-2026-73604).
author: Valters IT Security Research
date: 2026-01-15
logsource:
  category: webserver
  product: flowise
  definition: 'Requires Flowise API access logs or a reverse proxy (nginx/caddy) capturing HTTP requests to the Flowise application.'
detection:
  selection:
    http.method: GET
    http.url|contains: '/api/v1/credentials/'
  filter_known:
    http.url|endswith: '/api/v1/credentials'  # Exclusion of listing endpoint only
  condition: selection and not filter_known
  timeframe: 5m
  aggregation:
    - field: src.ip
      condition: gte(20)  # 20+ credential GET requests from same IP in 5 min
falsepositives:
  - Legitimate credential management by admins or operators during configuration
  - Automated backup or monitoring tools that periodically fetch credential metadata
level: medium
tags:
  - attack.t1552
  - cve.2026-73604
  - cwe.200

YARA Rule

rule Flowise_Credential_Exposure_CVE_2026_73604 {
    meta:
        author = "Valters IT Security Research"
        description = "Detects HTTP responses from Flowise credentials endpoint containing plaintext secrets"
        date = "2026-01-15"
        cve = "CVE-2026-73604"
        severity = "high"
    strings:
        $api_path = "/api/v1/credentials/" ascii wide nocase
        $api_key_pattern = /sk-[a-zA-Z0-9]{20,}/ nocase
        $private_key = /-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----/ ascii wide
        $uri_password = /[a-z]+:\/\/[^:\/]+:[^@]+@/ nocase  // user:pass@host in URL
        $google_json = "private_key" ascii wide nocase
        $conn_string = "mongodb://" ascii wide nocase
    condition:
        $api_path and any of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Flowise Credential Exfiltration Attempt (CVE-2026-73604)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v1/credentials/"; nocase; within:80; pcre:"/\/api\/v1\/credentials\/[a-zA-Z0-9_-]+$/"; threshold:type both, track by_src, count 20, seconds 300; reference:cve,2026-73604; classtype:attempted-user; sid:202673604; rev:1;)

Elastic Detection

// Detect enumeration of Flowise credentials endpoint
sequence by source.ip with maxspan=5m
  [ network where http.request.method == "GET" and
    http.request.uri : "/api/v1/credentials/*" ]
  until:
  // stop condition: response indicates large data exfiltration
  [ network where
    http.response.status_code == 200 and
    http.response.bytes > 10000 ]

Note: Adjust field names (http.request.uri, etc.) to match your Elastic ECS mapping.

Splunk SPL Query

index=web sourcetype=access_combined
| where method="GET" AND uri LIKE "%/api/v1/credentials/%"
| stats count as credential_requests by src_ip, uri
| where credential_requests >= 20
| eval alert_msg="Potential credential enumeration/exfiltration via CVE-2026-73604 from " + src_ip
| table _time, src_ip, uri, credential_requests, alert_msg
| sort -credential_requests

Wazuh OSSEC Rule

<group name="flowise, credentials, cve-2026-73604,">
  <rule id="736040" level="8">
    <decoded_as>json</decoded_as>
    <field name="method">GET</field>
    <field name="url">\./api/v1/credentials/\.*</field>
    <description>Flowise: GET request to credentials endpoint (possible CVE-2026-73604 exploitation)</description>
    <group>authentication_failed,</group>
  </rule>
</group>

Note: Requires configuring the Flowise API to output JSON-formatted access logs consumed by Wazuh.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. Flowise 3.1.3 is the first version reported as unaffected, and upgrading to ≥3.1.3 remains the fundamental remediation step. Organizations should verify this version exists in their vendor's release channel, as the CVE data does not confirm a public official release.

Immediate Mitigations (Days 0–7):

1. Restrict credentials:view permissions — Audit all user roles and API tokens. Revoke this permission from all non-essential accounts. Where role-based access control (RBAC) is available in Flowise, limit credentials:view to senior administrators only.
2. Enforce MFA — Require multi-factor authentication for all Flowise accounts, especially those retaining credentials:view, to raise the authentication barrier.
3. Network segmentation — Place the Flowise instance behind a reverse proxy (nginx, Caddy) with strict IP allow-listing. Restrict access to the administrative API to only authorized operator IPs.
4. Rotate all secrets stored in Flowise — Assume exposure risk is non-zero. Rotate database passwords, cloud service account keys, and API keys immediately. Schedule weekly rotation until patched.
5. Enable audit logging — Ensure Flowise access logs (or proxy logs) capture all API calls to /api/v1/credentials/:id; monitor for anomalous enumeration patterns using the detection rules above.

Patch/Upgrade Steps:

1. Confirm availability of Flowise ≥3.1.3 via the vendor's release notes (patch evidence is pending — 0/4 confidence).
2. If the version is available: back up your Flowise configuration and credential database before upgrading.
3. Upgrade using the official vendor upgrade path (npm update or Docker image pull).
4. After upgrade, rotate all credentials again — the exposure window may have existed in prior deployments.
5. Verify the redaction behavior post-upgrade by making an authorized API call and inspecting the response for any plaintext secret material.

Future/Unpatched State:

• If Flowise 3.1.3 is not yet released, treat the vulnerability as permanently exploited in your environment — assume all credentials stored in Flowise have been or will be compromised.
• Plan to completely rebuild the Flowise credential store after upgrading, never reusing prior secrets.

Long-Term Hardening:

1. Externalize secrets management — Migrate Flowise to use an external secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) as a backend, ensuring Flowise itself never stores decrypted secrets if possible.
2. Implement API gateway with anomaly detection — Deploy a WAF or API gateway with rate limiting and anomaly detection specifically for repeated credential endpoint access.
3. Adopt the principle of least privilege enterprise-wide — The credentials:view permission should be treated as a highly privileged role. Review user role assignments quarterly.
4. Monitor CVE feeds — Subscribe to vendor advisories and CVE monitoring for Flowise. Re-evaluate this report as new patch evidence emerges (the patch confidence may rise to 4/4 once the vendor publishes a fix).
5. Data classification and secret hygiene — Implement organizational policies that mandate the storage of cloud service account JSON files and database credentials only within designated secrets infrastructure, never in application databases.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73604 — Official NVD description and CVSS vector.
2. Flowise Official Repository (Github): https://github.com/FlowiseAI/Flowise — Monitor release tags and commit history for the 3.1.3 version milestone and any pending security patch.
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-73604 is NOT currently listed; re-check regularly for updates.
4. OWASP API Security Top 10 (2023): https://owasp.org/API-Security/editions/2023/en/0x11-t10/ — API9:2023 (Improper Inventory Management) and API3:2023 (Broken Object Property Level Authorization) contextualize the root failure of this vulnerability.
5. MITRE ATT&CK Technique T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/ — Primary tactic mapping for post-exploitation behavior.

Threat Actor Campaigns & In-the-Wild Exploitation: No known threat actor campaigns have been publicly attributed to this CVE. No exploit-in-the-wild evidence has been reported to CISA at the time of writing. The vulnerability's low exploitation complexity, however, makes it a strong candidate for inclusion in automated scanners and LLM-focused threat actor tooling. Organizations should monitor traffic to the vulnerable endpoint irrespective of public exploit availability.

Report prepared by Valters IT Security Research Team. This document is intended for authorized security assessment and defensive purposes only.