PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56268 Flowise CVE debrief

CVE-2026-56268 is an information disclosure vulnerability in Flowise, a platform used for building chatflows. The vulnerability exists in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omitted, which is the default behavior, the endpoint returns not only the chatflows bound to the supplied API key but also all chatflows across every workspace that have no API key assigned. This is because the underlying query lacks any workspace filter. As a result, an attacker with a valid API key for one workspace can retrieve the full configuration of unprotected chatflows belonging to other workspaces. The configuration includes flowData with system prompts and node configurations, chatbotConfig, apiConfig, and credential IDs.

Vendor
Flowise
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-22
Original CVE updated
2026-06-25
Advisory published
2026-06-22
Advisory updated
2026-06-25

Who should care

Organizations using Flowise before version 3.1.2 should be aware of this vulnerability. Specifically, administrators and security teams responsible for Flowise installations should assess their exposure and take necessary actions to mitigate the risk. This vulnerability could potentially allow attackers to gain unauthorized access to sensitive information across different workspaces.

Technical summary

The vulnerability is caused by the lack of a workspace filter in the query used by the /api/v1/chatflows/apikey/:apikey endpoint. When an API key is provided without the keyonly query parameter, the endpoint returns all chatflows, including those not bound to the supplied API key. This allows for unintended information disclosure across workspaces. The CVSS score for this vulnerability is 5.3, indicating a medium severity level.

Defensive priority

Given the medium severity of this vulnerability (CVSS score of 5.3) and its potential impact on data confidentiality, defenders should prioritize patching or mitigating this issue. Upgrading Flowise to version 3.1.2 or later is recommended to fix this vulnerability.

Recommended defensive actions

  • Upgrade Flowise to version 3.1.2 or later to fix the vulnerability.
  • Implement additional monitoring to detect and respond to potential exploitation attempts.
  • Review and restrict API key access and permissions to minimize exposure.
  • Consider implementing compensating controls, such as IP restrictions or additional authentication mechanisms, for the affected endpoint.
  • Conduct a thorough inventory of Flowise installations and configurations to identify potential vulnerabilities.

Evidence notes

The information provided is based on the CVE-2026-56268 record and related sources. The vulnerability was published on June 22, 2026, and last modified on June 25, 2026. The CVSS score is 5.3, with a medium severity level. The vulnerability affects Flowise versions prior to 3.1.2.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56268 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56268

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56268 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56268

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.