{"id":"CVE-2026-46443","aliases":["GHSA-7g73-99r4-m4mj"],"url":"https://o3.security/vulnerability/CVE-2026-46443","summary":"Flowise: Credential Data Leak","details":"**Severity**: HIGH (CVSS ~7.5)\n**Type**: CWE-200 (Exposure of Sensitive Information)\n**File**: `packages/server/src/services/credentials/index.ts:62-71`\n\n**Description**: When credentials are fetched with a `credentialName` filter parameter, the `encryptedData` field is NOT stripped from the response. The code properly omits `encryptedData` when NO filter is used (line 102) but fails to do so when a filter IS used (lines 62-63, 70-71).\nCredential Data Leak\n**Evidence**:\n```typescript\n// Lines 62-63: WITH filter - encryptedData LEAKED\nconst credentials = await appServer.AppDataSource.getRepository(Credential).findBy(searchOptions)\ndbResponse.push(...credentials)  // encryptedData NOT removed!\n\n// Lines 100-102: WITHOUT filter - encryptedData properly omitted\nfor (const credential of credentials) {\n    dbResponse.push(omit(credential, ['encryptedData']))  // Correctly omitted\n}\n```\n\n**Impact**: Authenticated users can extract encrypted credential data (API keys, passwords, tokens for services like OpenAI, AWS, etc.). Combined with access to the encryption key file (`~/.flowise/encryption.key` written with default permissions), this enables full credential theft.\n\n**Reproduction**:\n```bash\ncurl https://TARGET/api/v1/credentials?credentialName=openAIApi \\\n  -H \"Authorization: Bearer API_KEY\"\n# Response includes encryptedData field with AES-encrypted credentials\n```","published":"2026-06-08T15:30:59.580Z","modified":"2026-08-12T03:51:17.360355971Z","cvss":null,"epss":{"score":0.00271,"percentile":0.18806,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.2"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46443.json"},{"type":"ADVISORY","url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7g73-99r4-m4mj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46443"},{"type":"PACKAGE","url":"https://github.com/FlowiseAI/Flowise"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:17.360355971Z"}}