PatchTheCVECVE-2026-56272: Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the O
CVE-2026-56272 is a medium-severity flaw (CVSS 4.1) affecting flowise. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware, potentially compromising all user accounts in a database breach scenario.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.1 (Medium) |
| Attack vector | Local |
| Attack complexity | High |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 99%) |
| CISA exploited list | No |
| Weakness | CWE-916 |
| Published | 2026-06-24 |
| Last modified | 2026-10-25 |
Last updated 2026-10-25 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-56272?
flowise: upgrade to 3.0.13. Exact commands for each OS are on this page.
Is CVE-2026-56272 being exploited?
CVE-2026-56272 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-56272 affect?
CVE-2026-56272 affects flowise. Severity is medium (CVSS 4.1). Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware,
How urgent is CVE-2026-56272?
Priority 15/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-56268 HIGH 7.7 UPGRADE Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey
- CVE-2026-56275 HIGH 7.1 UPGRADE Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows
- CVE-2026-56269 MEDIUM 4.6 UPGRADE Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'S
- CVE-2026-58057 MEDIUM 5.0 UPGRADE Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitiv
- CVE-2026-56271 CRITICAL 9.8 UPGRADE Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_tok