CVE-2026-41266 - Vulnerability Analysis

Overview

Flowise < 3.1.0 contains an information disclosure vulnerability caused by unauthenticated access to /api/v1/public-chatbotConfig/:id endpoint, letting attackers retrieve sensitive API keys and internal configuration, exploit requires knowledge of chatflow UUID.

Severity & Score

Impact

Attackers can steal credentials and sensitive configuration data, leading to potential unauthorized access and further compromise.

Mitigation

Update to version 3.1.0 or later.

References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4jpm-cgx2-8h37

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner