Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-73604

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 28.7%
CVSS Severity
CVSS v3 Score 6.5
Products affected by CVE-2026-73604


Contact Us

Shodan ® - All rights reserved