CVE-2026-73604

CVE-2026-73604 exposes a credential retrieval endpoint in Flowise (GET /api/v1/credentials/:id) that returns plaintext credentials to any authenticated user holding the credentials:view permission. The vulnerability affects three credential formats—URL-embedded passwords, JSON structures with private keys, and raw API keys—because the endpoint reads from the same decrypted credential store that the orchestration engine uses for runtime operations. This isn't a rogue endpoint or a regression in redaction hygiene. Flowise must decrypt credentials to connect to databases, cloud services, and APIs on behalf of users—that's the system's core function. The retrieval endpoint isn't bypass code; it's reading from the same plaintext store the runtime depends on. The missing redaction is a structural gap, not an anomaly. The credentials:view permission tells you the developers explicitly considered access control, which means this is likely an implementation gap rather than design neglect. They likely added redaction where secrets appeared unexpectedly—in logs, errors, or known leakage points—but treated the credential retrieval endpoint as a legitimate read path that didn't need masking. The mental model gap: developers are trained to protect against unexpected credential exposure (don't log passwords, don't echo in errors), but authenticated retrieval of one's own credentials is the intended happy path, not a failure mode in standard training. The blast radius extends well beyond the direct disclosure. Once plaintext credentials exist in the API response, they propagate to every downstream system that touches that response: browser caches, server logs, reverse proxies, monitoring pipelines, execution artifacts. Flowise amplifies this because it's an integration point—a successful exploit exposes not just a credential but the entire access chain: where your PostgreSQL lives, what database you're running, what other systems share that credential. That's lateral movement capability disguised as information disclosure. Check these specific conditions: whether the credentials:view permission validates resource ownership (user can only fetch their own credentials) or only checks the permission class (any authenticated user can fetch any credential by UUID—making this a lateral movement vector). Verify whether other endpoints that consume credentials have the same incomplete redaction. And account for downstream exposure in your remediation—patching the server-side endpoint doesn't flush credential plaintext from browser caches, proxy buffers, or log aggregators that may already have ingested it.

Reviewed through automated stages and approved by a human before publication.