CVE-2026-41278

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GET /api/v1/public-chatflows/:id endpoint returns the full chatflow object without sanitization for public chatflows. Docker validation revealed this is worse than initially assessed: the sanitizeFlowDataForPublicEndpoint function does NOT exist in the released v3.0.13 Docker image. Both public-chatflows AND public-chatbotConfig return completely raw flowData including credential IDs, plaintext API keys, and password-type fields. This vulnerability is fixed in 3.1.0.

• CWE-200

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w47f-j8rh-wx87Exploit, Vendor Advisory

Published

Apr 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41272Flowise is a drag & drop user interface to build a customize…7.1
• CVE-2026-41273Flowise is a drag & drop user interface to build a customize…8.2
• CVE-2026-41274Flowise is a drag & drop user interface to build a customize…9.8
• CVE-2026-41275Flowise is a drag & drop user interface to build a customize…7.5
• CVE-2026-41276Flowise is a drag & drop user interface to build a customize…9.8
• CVE-2026-41277Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-41279Flowise is a drag & drop user interface to build a customize…7.5
• CVE-2026-4128The TP Restore Categories And Taxonomies plugin for WordPres…4.3
• CVE-2026-41280Incorrect Authorization vulnerability allows users with syst…4.9
• CVE-2026-41281Android App "あんしんフィルター for au" provided by KDDI CORPORATION …6.3
• CVE-2026-41282ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression…7.5
• CVE-2026-41283OpenStack Mistral through 22.0.0 allows Arbitrary Remote Cod…9.9