PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56268 Flowise CVE debrief

CVE-2026-56268 is an information disclosure vulnerability in Flowise, a platform used for building chatflows. The vulnerability exists in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omitted, which is the default behavior, the endpoint returns not only the chatflows bound to the supplied API key but also all chatflows across every workspace that have no API key assigned. This is because the underlying query lacks any workspace filter. As a result, an attacker with a valid API key for one workspace can retrieve the full configuration of unprotected chatflows belonging to other workspaces. The configuration includes flowData with system prompts and node configurations, chatbotConfig, apiConfig, and credential IDs.

Vendor
Flowise
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-22
Original CVE updated
2026-06-25
Advisory published
2026-06-22
Advisory updated
2026-06-25

Who should care

Organizations using Flowise before version 3.1.2 should be aware of this vulnerability. Specifically, administrators and security teams responsible for Flowise installations should assess their exposure and take necessary actions to mitigate the risk. This vulnerability could potentially allow attackers to gain unauthorized access to sensitive information across different workspaces.

Technical summary

The vulnerability is caused by the lack of a workspace filter in the query used by the /api/v1/chatflows/apikey/:apikey endpoint. When an API key is provided without the keyonly query parameter, the endpoint returns all chatflows, including those not bound to the supplied API key. This allows for unintended information disclosure across workspaces. The CVSS score for this vulnerability is 5.3, indicating a medium severity level.

Defensive priority

Given the medium severity of this vulnerability (CVSS score of 5.3) and its potential impact on data confidentiality, defenders should prioritize patching or mitigating this issue. Upgrading Flowise to version 3.1.2 or later is recommended to fix this vulnerability.

Recommended defensive actions

  • Upgrade Flowise to version 3.1.2 or later to fix the vulnerability.
  • Implement additional monitoring to detect and respond to potential exploitation attempts.
  • Review and restrict API key access and permissions to minimize exposure.
  • Consider implementing compensating controls, such as IP restrictions or additional authentication mechanisms, for the affected endpoint.
  • Conduct a thorough inventory of Flowise installations and configurations to identify potential vulnerabilities.

Evidence notes

The information provided is based on the CVE-2026-56268 record and related sources. The vulnerability was published on June 22, 2026, and last modified on June 25, 2026. The CVSS score is 5.3, with a medium severity level. The vulnerability affects Flowise versions prior to 3.1.2.

Official resources

This article is AI-assisted and based on the supplied source corpus.