Security Advisory

CVE-2026-73604

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-13 11:28:10

Last updated 2026-08-13 14:52:32

Assigner VulnCheck

CVSS score not scored

State PUBLISHED

Description

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.

← Browse all CVEs View on cve.org ↗