GHSA-w47f-j8rh-wx87: Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs

Summary

The GET /api/v1/public-chatflows/:id endpoint in Flowise returns the full chatflow object without sanitization when a chatflow is public. In Docker validation against v3.0.13, the sanitizeFlowDataForPublicEndpoint function is absent from the released image, and both public-chatflows and public-chatbotConfig return raw flowData containing credential IDs, plaintext API keys, and passwords.

Mitigation

Apply sanitization to both public endpoints, using sanitizeFlowDataForPublicEndpoint on the chatflow before returning it, and ensure the function strips all credential, password, apiKey and secretKey fields from flowData.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12

Related items

• MediumAI coding agents expose developer screenshots on GitHub reposSimilar attack · ReversingLabs Blog
• InfoHow to Secure AI Models in Production Environments | Endor LabsSimilar attack · Endor Labs Blog
• InfoLLM Development Risks: Security Threats and Mitigation Strategies | Endor LabsSimilar attack · Endor Labs Blog
• InfoWhen Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM SystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoStrengthening our defenses against distillation attacksSimilar attack · Anthropic Research Blog