GHSA-4jpm-cgx2-8h37: Flowise: Sensitive Data Leak in public-chatbotConfig

Summary

The /api/v1/public-chatbotConfig/:id endpoint in Flowise returns the full flowData object without authentication or sanitization, through the getSinglePublicChatbotConfig function in packages/server/src/services/chatflows/index.ts. An attacker who knows only a chatflow UUID, which can be obtained from embedded chat widgets, referrer headers or logs, can retrieve plaintext password-type fields such as unstructuredAPIKey and HTTP Authorization headers. The impact covers all Flowise Cloud users with such chatflows and self-hosted instances exposed to the internet.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12

Topics

• Training data and privacy

Related items

• MediumAI coding agents expose developer screenshots on GitHub reposSimilar attack · ReversingLabs Blog
• InfoHow to Secure AI Models in Production Environments | Endor LabsSimilar attack · Endor Labs Blog
• InfoLLM Development Risks: Security Threats and Mitigation Strategies | Endor LabsSimilar attack · Endor Labs Blog
• InfoWhen Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM SystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoStrengthening our defenses against distillation attacksSimilar attack · Anthropic Research Blog