Use of hard-coded credentials in Flowise - #VU126237
Published: April 15, 2026
Vulnerability identifier: #VU126237
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-798
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to disclose sensitive information and manipulate token metadata.
The vulnerability exists due to use of hard-coded credentials in tempTokenUtils.ts when deriving the token encryption key from an unset TOKEN_HASH_SECRET environment variable. A local privileged user can use the weak default secret to decrypt and modify encrypted token metadata to disclose sensitive information and manipulate token metadata.
User interaction is required, and the issue is exposed only when TOKEN_HASH_SECRET is not configured.
Affected software
Flowise
Remediation
Install security update from vendor's website.
Flowise - update to 3.1.0