CVE-2026-56272: Flowise Weak Bcrypt Salt Rounds Enable Faster Password Cracking

Technical summary

CVE-2026-56272 identifies insufficient use of bcrypt salt rounds in Flowise authentication. Bcrypt's computational cost is governed by the salt round parameter; each additional round doubles the hashing time. Flowise's default configuration of 5 rounds (2^5 = 32 iterations) falls well below the OWASP minimum recommendation of 10 rounds (2^10 = 1,024 iterations). Modern GPU-accelerated password cracking tools can exploit this 32x iteration gap to perform dictionary and brute-force attacks at dramatically accelerated rates. The vulnerability is classified as CWE-916 (Use of Password Hash With Insufficient Computational Effort).

Business impact

This weakness directly undermines the confidentiality of user credentials stored in Flowise deployments. While the immediate CVSS impact is limited because the vulnerability requires local access to a breached database, the practical consequence is severe: any unauthorized database access—whether via SQL injection, insider threat, or cloud misconfiguration—becomes significantly more likely to result in compromised user accounts. Organizations running Flowise must assume that if their database is ever extracted, account recovery times are compressed from weeks or months to days or hours.

Affected systems

Flowise versions before 3.0.13 are affected. This includes all installations running version 3.0.12 and earlier. The vulnerability affects any Flowise deployment that has not applied the patched version. Both self-hosted and managed instances are in scope if not updated.

Exploitability

Exploitation requires prior unauthorized access to the user password hash database—this is not a remote code execution vector and does not grant initial access to systems. However, once an attacker has obtained hashes (through database breach, backup theft, or insider access), the weak salt configuration makes offline password cracking highly efficient. GPU-equipped attackers can process dictionary attacks and targeted brute-force attempts at approximately 30 times faster rates than would be possible with properly configured bcrypt. No special tools or zero-day techniques are required; standard password cracking utilities and commodity hardware provide sufficient advantage.

Remediation

Upgrade Flowise to version 3.0.13 or later immediately. The patched version corrects the default salt round configuration to meet OWASP standards. Organizations should also conduct a password reset campaign post-upgrade to ensure all existing hashes (generated with weak parameters) are replaced with new credentials hashed under the corrected configuration. Additionally, review database access logs and backup integrity to assess whether hash extraction has already occurred.

Patch guidance

Apply Flowise version 3.0.13 or later to all running instances. Verify the upgrade by confirming the version string and testing that new user account creation uses the corrected salt round parameter. Following patching, require all users to reset their passwords to ensure credentials are re-hashed with the stronger configuration. For organizations unable to patch immediately, implement compensating controls: restrict database access via network segmentation, enforce strong monitoring for unauthorized database queries, and increase backup security to prevent hash extraction.

Detection guidance

Monitor bcrypt hash generation in Flowise logs or application instrumentation to confirm salt round values are 10 or higher post-patch. If forensic review of historical hashes is possible, verify that pre-3.0.13 hashes show evidence of the weak 5-round configuration. In breach response scenarios, prioritize analysis of Flowise user tables and test a sample of extracted hashes against common wordlists using standard cracking tools—noticeably faster success rates would confirm the vulnerability was exploited. Alert on any successful authentication attempts using credentials that were previously reset, which may indicate prior cracking.

Why prioritize this

Although the CVSS score is moderate (4.1), this vulnerability deserves prompt attention because it fundamentally weakens the security of a critical authentication control. The gap between current and recommended practice is large (5x computational iteration shortfall), making the practical security impact substantial in any breach scenario. Organizations that store sensitive data or user PII within Flowise should treat this as high priority for patching within their standard update cycle. The lack of KEV status and low attack surface (requires database access) mean this is not an emergency, but delay increases the window in which a breach could fully compromise user credentials.

Risk score, explained

The CVSS 3.1 score of 4.1 (MEDIUM) reflects the constraint that initial compromise requires local or privileged access to the database—there is no remote attack vector. Confidentiality impact is rated high because successful offline cracking can fully disclose user passwords. However, integrity and availability are unaffected, and the attack complexity is rated high due to the requirement for database-level access. The score appropriately penalizes the requirement for pre-breach database theft, but understates the practical severity of the hash-cracking advantage once that threshold is crossed. Risk stratification should weigh organizational exposure: cloud deployments with broad database access or organizations handling sensitive user data should treat this as a higher priority than the base score alone suggests.

Frequently asked questions