Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration without any authentication. An attacker with knowledge just of a chatflow UUID can retrieve credentials stored in password type fields and HTTP headers, leading to credential theft and more. This vulnerability is fixed in 3.1.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-23 | 1 | Disclosure1 |
| 2026-05-14 | 1 | General1 |
🔴 #Flowise, Credential Data Leak, #CVE-2026-41266 (High) https://dailycve.com/flowise-credential-data-leak-cve-2026-41266-high/
Post summary
The text announces a high‑severity credential data leak CVE but offers no additional details such as PoC, patches, or active exploitation evidence.
CVE-2026-41266 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive data in… https://www.cve.org/CVERecord?id=CVE-2026-41266
Post summary
CVE-2026-41266 highlights an information‑disclosure flaw in Flowise’s API endpoint prior to version 3.1.0, exposing sensitive data.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | flowiseai | flowise | - | - | - |