Vulnerability Database

383,463

Total vulnerabilities in the database

Flowise: Incomplete Credential Redaction Exposes Secrets via API — flowise

Exposure of Sensitive Information to an Unauthorized Actor

Summary

The GET /api/v1/credentials/:id endpoint decrypts stored credential data and returns it in the plainDataObj field of the API response. While a redactCredentialWithPasswordType() function masks fields defined with type: 'password' in their component schema, many credential types store highly sensitive data (database connection URLs with embedded passwords, Google service account JSON with RSA private keys, AWS access keys) in fields defined as type: 'string'. These string-type fields are returned in full plaintext without any redaction.

Any authenticated user with credentials:view permission can retrieve the raw secrets of any credential in their workspace by calling this endpoint.

Vulnerable Code

Service Layer

packages/server/src/services/credentials/index.ts, getCredentialById() (line 127):

At line 138, the credential's encrypted data is decrypted:

const decryptedCredentialData = await decryptCredentialData( credential.encryptedData, credential.credentialName, appServer.nodesPool.componentCredentials )

At lines 143-146, the decrypted data is attached to the response as plainDataObj:

const returnCredential: ICredentialReturnResponse = { ...credential, plainDataObj: decryptedCredentialData // <-- decrypted secrets in response }

At line 147, only encryptedData is stripped, leaving plainDataObj intact:

const dbResponse: any = omit(returnCredential, ['encryptedData'])

Incomplete Redaction

packages/server/src/utils/index.ts, redactCredentialWithPasswordType() (line 1697):

export const redactCredentialWithPasswordType = ( componentCredentialName: string, decryptedCredentialObj: ICredentialDataDecrypted, componentCredentials: IComponentCredentials ): ICredentialDataDecrypted => { const plainDataObj = cloneDeep(decryptedCredentialObj) for (const cred in plainDataObj) { const inputParam = componentCredentials[componentCredentialName].inputs?.find( (inp) => inp.type === 'password' && inp.name === cred // <-- only 'password' type ) if (inputParam) { plainDataObj[cred] = REDACTED_CREDENTIAL_VALUE } } return plainDataObj }

This function only redacts fields where inp.type === 'password'. Fields with type: 'string' are returned verbatim, even when they contain secrets.

Credential Definitions Storing Secrets in String-Type Fields

| Credential | Field | Type | Contains | |---|---|---|---| | mongoDBUrlApi | mongoDBConnectUrl | string | mongodb+srv://user:password@host/db | | googleVertexAuth | googleApplicationCredential | string | Full service account JSON with RSA private key | | postgresUrl | postgresUrl | string | postgresql://user:password@host/db | | redisCacheUrlApi | redisUrl | string | redis://user:password@host:port | | awsApi | awsKey | string | AWS Access Key ID | | langfuseApi | langFusePublicKey | string | Langfuse API public key | | httpBasicAuth | basicAuthUsername | string | HTTP Basic Auth username |

There are 60+ credential definitions in packages/components/credentials/, many with sensitive string-type fields.

Proof of Concept

Environment

  • Flowise v3.0.13 (flowiseai/flowise:latest Docker image)
  • Authenticated as admin user via enterprise auth

Steps to Reproduce

  1. Start Flowise and log in as any user with credentials:view permission.
  2. Create a MongoDB credential with a connection URL containing embedded credentials:
curl -X POST "http://TARGET:3000/api/v1/credentials" \ -H "Content-Type: application/json" \ -H "x-request-from: internal" \ -H "Cookie: token=<jwt-token>" \ -d '{ "name": "MongoDB Production", "credentialName": "mongoDBUrlApi", "plainDataObj": { "mongoDBConnectUrl": "mongodb+srv://admin:[email protected]/mydb" } }'
  1. Retrieve the credential by ID:
curl -X GET "http://TARGET:3000/api/v1/credentials/<credential-id>" \ -H "x-request-from: internal" \ -H "Cookie: token=<jwt-token>"

Observed Result

The API returns the MongoDB connection URL in full plaintext, including the embedded password:

{ "id": "e9543cad-8c0c-422e-9990-090c3b1dc3ab", "name": "MongoDB Production", "credentialName": "mongoDBUrlApi", "createdDate": "2026-02-07T17:35:29.000Z", "updatedDate": "2026-02-07T17:35:29.000Z", "plainDataObj": { "mongoDBConnectUrl": "mongodb+srv://admin:[email protected]/mydb" } }

The same test with a Google Vertex Auth credential returned the complete service account JSON including the RSA private key in plaintext:

{ "id": "f7768444-a4fc-4fa3-8e5e-d0d4df89fb56", "name": "Google Vertex Auth", "credentialName": "googleVertexAuth", "plainDataObj": { "googleApplicationCredential": "{\"type\":\"service_account\",\"private_key\":\"-----BEGIN RSA PRIVATE KEY-----\\nMIIEpAIBAAKCAQEA0Z3VS5JJcds3xfn/ygWep4PAtGoL3VBpFe97XRQFQB\\n-----END RSA PRIVATE KEY-----\\n\",\"client_email\":\"[email protected]\"}", "projectID": "my-project-123" } }

For comparison, an OpenAI API key (where the field is typed as password) was correctly redacted:

{ "plainDataObj": { "openAIApiKey": "_FLOWISE_BLANK_07167752-1a71-43b1-" } }

This confirms the redaction is only applied to password-type fields, leaving string-type fields fully exposed.

Impact

  • Database credential theft: MongoDB, PostgreSQL, Redis, MySQL connection URLs with embedded passwords are returned in full plaintext. An attacker can use these to directly access production databases.
  • Cloud service account compromise: Google service account JSON with RSA private keys is returned in plaintext, enabling full impersonation of the service account across Google Cloud.
  • AWS key exposure: AWS Access Key IDs stored in string-type fields are exposed, enabling enumeration of active AWS credentials.
  • Lateral movement: Stolen credentials enable pivoting from the Flowise instance to connected cloud services, databases, and APIs.
  • Multi-user workspace risk: In multi-user deployments, any user with credentials:view permission can harvest all workspace credentials via the API.

Remediation

  1. Apply redactCredentialWithPasswordType() to all sensitive credential fields, not just those typed as password. Any field containing secrets (connection strings, JSON credentials, access keys) should be redacted.
  2. Consider never returning plainDataObj in API responses. The UI should use masked previews (e.g., mongodb+srv://admin:****@cluster0...) instead of full values.
  3. Re-type sensitive credential fields from string to password in component credential definitions to ensure they are covered by the existing redaction logic.
  4. Add a separate secret: true flag to credential field definitions to explicitly mark sensitive fields regardless of their input type.
  • Published: Aug 4, 2026
  • Updated: Aug 5, 2026
  • GHSA: GHSA-rwrp-9823-p2xq
  • Severity: Medium
  • Exploit:
  • CISA KEV:

CVSS v3:

  • Severity: Medium
  • Score: 6.5
  • AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWEs:

Software Affected versions
Node.js icon flowise < 3.1.3

Frequently Asked Questions

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.