CVE-2026-56269

Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKEN_HASH_SECRET environment variable in packages/server/src/enterprise/utils/tempTokenUtils.ts when the variable is not configured. This secret derives the AES-256-CBC key used to encrypt user IDs and workspace IDs in the 'meta' field of JWT tokens. An attacker who knows the default secret can decrypt this metadata to extract internal user and workspace identifiers, and re-encrypt manipulated values such as altered user or workspace IDs. Because the JWT signature is validated separately, decrypting or tampering with this metadata does not by itself grant access, but the disclosure of internal identifiers and possible metadata manipulation could aid privilege escalation or unauthorized data access.

• CWE-798

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-m7mq-85xj-9x33Mitigation, Vendor Advisory
• https://www.vulncheck.com/advisories/flowise-weak-default-token-hash-secret-in-jwt-token-encryptionThird Party Advisory

Published

Jun 24, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56263Crawl4AI before 0.8.7 contains a stored cross-site scripting…6.1
• CVE-2026-56264Crawl4AI before 0.8.7 contains an arbitrary JavaScript execu…6.1
• CVE-2026-56265Crawl4AI before 0.8.7 contains an authentication bypass vuln…9.8
• CVE-2026-56266Crawl4AI before 0.8.7 contains a server-side request forgery…8.6
• CVE-2026-56267Flowise before 3.0.13 contains an information exposure vulne…6.9
• CVE-2026-56268Flowise before 3.1.2 contains an information disclosure vuln…7.7
• CVE-2026-5627A path traversal vulnerability exists in mintplex-labs/anyth…7.2
• CVE-2026-56270Flowise before 3.1.0 (versions 3.0.13 and earlier) contains …7.5
• CVE-2026-56271Flowise before 3.1.0 (affected versions 3.0.13 and earlier) …9.8
• CVE-2026-56272Flowise before 3.0.13 uses bcrypt with default salt rounds o…5.6
• CVE-2026-56273Flowise before 3.1.0 contains a path traversal vulnerability…6.5
• CVE-2026-56274Flowise before 3.1.2 contains multiple OS command injection …9.9