Flowise: public chatflow endpoints return raw flowData including plaintext API keys

Impact

The public chatflow endpoints return the full, unsanitized chatflow object to anyone who can reach them - credential IDs, plaintext API keys and password-type fields included. The advisory notes the sanitizeFlowDataForPublicEndpoint function is absent entirely from the released v3.0.13 container image, so both public-chatflows and public-chatbotConfig leak raw flowData. For an operator, this is unauthenticated theft of whatever credentials the LLM pipelines hold: model provider keys that bill to the operator, vector store and database credentials, and internal service tokens that give an attacker a second hop off the serving node. Exposure follows the chatflow, so one published demo flow can leak the keys used fleet-wide.

Who can reach it

Network, no authentication: anyone who can reach the Flowise HTTP endpoint and knows or enumerates a public chatflow id.

What to do

Upgrade Flowise to 3.1.0 or later and restart the service. Because the keys were served in plaintext to unauthenticated callers, rotate every credential that was referenced by a public chatflow - upgrading does not undo prior disclosure. In the meantime, block the public-chatflows and public-chatbotConfig paths at the ingress and unpublish public chatflows.

References

Related entries

• Nocturne Memory: empty API_TOKEN disables auth, exposing the agent knowledge graph to the LANCVE-2026-44830 · Nocturne Memory (BearerTokenAuthMiddleware when API_TOKEN is unset)High
• vLLM: user-supplied structured-output regex compiles with no timeout, hanging an inference workerCVE-2026-55574 · vLLM structured_outputs.regex (xgrammar / outlines grammar compilation)High
• Hugging Face Datasets: pickle-backed pandas builder executes code from a dataset file on loadCVE-2026-57845 · Hugging Face Datasets (deprecated pandas packaged builder, Pandas._generate_tables)High
• XAgent: path traversal in the workspace file endpoint reads any host file outside the Docker sandboxCVE-2026-72713 · XAgent (OpenBMB) workspace file endpoint `/workspace/file`High
• Xinference: model launch API executes attacker-supplied Python because trust_remote_code is always onCVE-2026-76841 · Xinference (Xorbits Inference) model loaders - trust_remote_codeHigh
• Coze Studio: any registered user gets code execution from a workflow code node by defaultCVE-2026-77934 · Coze Studio (workflow code node, unsandboxed python3 subprocess)High