Home / Vulnerability Intelligence / CVE-2026-41278

CVE-2026-41278 - Vulnerability Analysis

HighCVSS: 7.5

Last Updated: April 24, 2026

Flowise - Information Disclosure

Published: April 23, 2026Updated: April 24, 2026PoC AvailableRemote Exploitable

Overview

Flowise < 3.1.0 contains an information disclosure vulnerability caused by lack of sanitization in GET /api/v1/public-chatflows/:id endpoint, letting remote attackers access sensitive credentials and API keys, exploit requires access to the endpoint.

Severity & Score

Severity: High

CVSS Score: 7.5

Impact

Attackers can access sensitive credentials and API keys, leading to potential account compromise and data leakage.

Mitigation

Update to version 3.1.0 or later.

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w47f-j8rh-wx87

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-41278
Severity: High
CVSS Score: 7.5
Type: information_disclosure
Status: confirmed

CWE

CWE-200

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N