THREAT OPS › Threat News › [NVD] CVE-2026-73604 (MEDIUM 6.5) — Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection U
[NVD] CVE-2026-73604 (MEDIUM 6.5) — Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection U
CVE-2026-73604 CVSS: 6.5 MEDIUM Published: 2026-08-13T12:17:24.750
Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account J
MITRE ATT&CK techniques
Indicators of compromise
- CVE-2026-73604cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-73604