THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-rwrp-9823-p2xq (medium) — Flowise: Incomplete Credential Redaction Exposes Secrets via API

[GHSA] GHSA-rwrp-9823-p2xq (medium) — Flowise: Incomplete Credential Redaction Exposes Secrets via API

highgithub_advisoriesPublished 2026-08-04

GHSA-rwrp-9823-p2xq Severity: medium CVE: None

Flowise: Incomplete Credential Redaction Exposes Secrets via API

## Summary

The `GET /api/v1/credentials/:id` endpoint decrypts stored credential data and returns it in the `plainDataObj` field of the API response. While a `redactCredentialWithPasswordType()` function masks fields defined with `type: 'password'` in their component schema, many cred

MITRE ATT&CK techniques

Private KeysT1552.004
Cloud ServicesT1021.007
CredentialsT1589.001
ImpersonationT1684.001
ImpersonationAML.T0073

Indicators of compromise

http://TARGET:3000/api/v1/credentialsurl
http://TARGET:3000/api/v1/credentials/url
supersecretpassword123@cluster0.abc123.mongodb.netemail
mybot@my-project-123.iam.gserviceaccount.comemail

Original source: https://github.com/advisories/GHSA-rwrp-9823-p2xq