Flowise: Incomplete Credential Redaction Exposes Secrets via API

Summary The GET /api/v1/credentials/:id endpoint decrypts stored credential data and returns it in the plainDataObj field of the API response. While a redactCredentialWithPasswordType function masks fields defined with type: 'password' in their component schema, many credential types store highly...

PT-2026-71432

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An incomplete credential redaction issue exists where the 'GET /api/v1/credentials/:id' endpoint returns decrypted secrets in plaintext. Authenticated users possessing the credentials:view permission...