Use of hard-coded credentials in Flowise - CVE-2026-56278
Published: April 15, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU126238
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-56278
CWE-ID: CWE-798
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to disclose sensitive information and modify application state by forging session cookies.
The vulnerability exists due to use of hard-coded credentials in the express-session secret configuration when the EXPRESS_SESSION_SECRET environment variable is not set. A local privileged user can create forged session cookies to disclose sensitive information and modify application state by impersonating arbitrary users.
The issue is exposed only when the application uses the default secret value 'flowise', and user interaction is required.
Affected software
Flowise
How to mitigate CVE-2026-56278
Install security update from vendor's website.
Flowise - update to 3.1.0