Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Flowise

CVE-2026-8026: Flowise: Bcrypt Password Hash Exposure

mediumCVSS 4.0 6.3 · 3.1 3.7GHSA-8f47-4rh3-x44m

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult.

Published May 6, 2026 · Updated May 12, 2026

Affected packages

flowise

Ecosystem
npm
Affected
<= 3.0.12
Fixed in
No patched version yet
Check
npm ls flowise

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Flowise vulnerabilities

All Flowise entries