CVE-2026-41278: Flowise public chatflow endpoint exposes unsanitized chatflow data

Summary

CVE-2026-41278 affects Flowise before 3.1.0. The GET /api/v1/public-chatflows/:id endpoint returns the full chatflow object without sanitization for public chatflows. Docker validation found the sanitizeFlowDataForPublicEndpoint function absent from the released v3.0.13 Docker image, and both public-chatflows and public-chatbotConfig return raw flowData, including credential IDs, plaintext API keys, and password-type fields.

Mitigation

Fixed in 3.1.0.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12

Related items

• InfoGem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization FrameworkSimilar attack · OpenAlex (peer-reviewed AI security)
• MediumCVE-2026-88982: Kubeflow Pipelines execution cache exposes cached outputs across namespacesSimilar attack · NVD/CVE Database
• MediumChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data ExfiltrationSimilar attack · Check Point Research
• MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSimilar attack · BleepingComputer
• LowExtracting System Prompt of LLM Services in Complex (Agentic) Settings: Hierarchical Optimization and Reliable Evaluation MetricsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)