CVE-2026-56268: Flowise Information Disclosure via Cross-Workspace API Key Enumeration

Technical summary

CVE-2026-56268 is an authorization bypass and information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint of Flowise. The vulnerability arises from insufficient workspace isolation in the query logic. When a client omits the optional keyonly query parameter (the default behavior), the endpoint returns both (1) chatflows bound to the supplied API key and (2) all chatflows without assigned API keys across every workspace. Because the underlying database query lacks a workspace filter, an authenticated user with a valid API key for one workspace can enumerate and retrieve full ChatFlow objects—including flowData with system prompts, node configurations, chatbotConfig, apiConfig, and credential references—belonging to other workspaces. This is a direct violation of CWE-863 (Incorrect Authorization).

Business impact

The exposure of system prompts and node configurations across workspace boundaries could reveal proprietary business logic, AI model tuning, and deployment strategies. Credential IDs disclosed in this manner enable subsequent targeted attacks on integrated external systems. For multi-tenant deployments or organizations sharing a Flowise instance, this creates a cross-tenant data leak risk. Competitors or malicious insiders could map the architecture and behavior of AI workflows belonging to other business units or clients, undermining confidentiality and competitive advantage.

Affected systems

Flowise versions prior to 3.1.2 are affected. The vulnerability requires an attacker to possess at least one valid API key to any workspace on the target Flowise instance; the /api/v1/chatflows/apikey endpoint is unauthenticated by API key alone but requires network access to the Flowise service. All multi-workspace or multi-tenant Flowise deployments are at risk, particularly those with unprotected chatflows (i.e., chatflows without assigned API keys).

Exploitability

Exploitability is moderate to high. The attack requires only a valid API key—a low barrier if the attacker is an internal user, contractor, or has compromised credentials. No user interaction is needed; the exploit is a simple HTTP GET request. However, the attacker must have network access to the Flowise instance and knowledge of the vulnerable endpoint structure. The default behavior (omitting keyonly) makes exploitation straightforward without special payload crafting. Public documentation or reconnaissance of Flowise deployments would reveal the endpoint pattern.

Remediation

Upgrade Flowise to version 3.1.2 or later immediately. The patch addresses the vulnerability by enforcing workspace filtering in the query logic, ensuring that API key lookups return only chatflows associated with the authenticated workspace. Verify against the official Flowise release notes and security advisories to confirm patch status. If immediate patching is not possible, consider temporarily disabling or restricting access to the /api/v1/chatflows/apikey endpoint via firewall or reverse proxy rules until an update can be deployed.

Patch guidance

Download and deploy Flowise 3.1.2 or a later stable release. Follow the vendor's upgrade instructions, paying attention to any database migrations or configuration changes. Test the patched version in a non-production environment first to ensure compatibility with existing custom nodes, integrations, and workflows. After deployment, verify that the endpoint now respects workspace boundaries by testing with API keys from different workspaces and confirming that chatflows from other workspaces are no longer returned.

Detection guidance

Monitor access logs for the /api/v1/chatflows/apikey endpoint, particularly requests that omit or do not set the keyonly parameter. Baseline normal API key request patterns per workspace and flag anomalous cross-workspace queries. Search logs for instances where a single API key retrieves an unusually high number of chatflows or retrieves chatflows with timestamps or metadata inconsistent with the requesting workspace. Query application performance monitoring (APM) tools for chatflow API calls that return large result sets. If available, enable audit logging on the endpoint to capture query parameters and returned chatflow IDs. Review audit trails for any API key creation or changes during the vulnerability exposure window.

Why prioritize this

This vulnerability merits immediate prioritization because it enables cross-workspace data exfiltration with only low-privilege access (a single API key) and no user interaction. The exposed data—system prompts, node configurations, and credential references—directly undermines the confidentiality of AI workflows and adjacent systems. The CVSS 7.7 HIGH score reflects the combination of network accessibility, low attack complexity, and confidentiality breach across security boundaries. Organizations running multi-workspace Flowise instances or hosting multiple clients should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 7.7 (HIGH) is driven by: AV:N (network-accessible endpoint), AC:L (trivial exploitation, standard HTTP request), PR:L (requires only one valid API key, a low privilege), UI:N (no user interaction needed), S:C (scope change—crosses workspace boundaries), C:H (confidentiality completely compromised for unprotected chatflows), I:N (no integrity impact), A:N (no availability impact). The scope change elevation and high confidentiality impact reflect the severity of cross-tenant or cross-workspace data leakage.

Frequently asked questions