PatchTheCVECVE-2026-56269: Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'S
CVE-2026-56269 is a medium-severity flaw (CVSS 4.6) affecting flowise. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKEN_HASH_SECRET environment variable in packages/server/src/enterprise/utils/tempTokenUtils.ts when the variable is not configured. This secret derives the AES-256-CBC key used to encrypt user IDs and workspace IDs in the 'meta' field of JWT tokens. An attacker who knows the default secret can decrypt this metadata to ex
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.6 (Medium) |
| Attack vector | Local |
| Attack complexity | High |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 0.1% (top 97%) |
| CISA exploited list | No |
| Weakness | CWE-798 |
| Published | 2026-06-24 |
| Last modified | 2026-10-25 |
Last updated 2026-10-25 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-56269?
flowise: upgrade to 3.1.0. Exact commands for each OS are on this page.
Is CVE-2026-56269 being exploited?
CVE-2026-56269 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-56269 affect?
CVE-2026-56269 affects flowise. Severity is medium (CVSS 4.6). Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKEN_HASH_SECRET environment variable in packages/server/src/enterprise/utils/tempTokenUtils.ts when the variable
How urgent is CVE-2026-56269?
Priority 17/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2026-56268 HIGH 7.7 UPGRADE Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey
- CVE-2026-56275 HIGH 7.1 UPGRADE Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows
- CVE-2026-56272 MEDIUM 4.1 UPGRADE Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the O
- CVE-2026-58057 MEDIUM 5.0 UPGRADE Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitiv
- CVE-2026-56271 CRITICAL 9.8 UPGRADE Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_tok