🛡️ CVE-2026-56278 — flowise

🔴 CVSS 9.1 — Critical ✅ No Known Exploit CWE-798 OSV
9.1
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Flowise: Weak Default Express Session Secret

Detection Method: Kolega.dev Deep Code Scan

| Attribute | Value |

|---|---|

| Location | packages/server/src/enterprise/middleware/passport/index.ts:55 |

| Practical Exploitability | High |

| Developer Approver | [email protected] |

Description

Express session secret has a weak default value 'flowise' when EXPRESS_SESSION_SECRET is not set.

Affected Code

```

secret: process.env.EXPRESS_SESSION_SECRET || 'flowise'

```

Evidence

The default session secret 'flowise' is publicly visible and weak. Session cookies signed with this secret can be forged by attackers.

Impact

Session hijacking and forgery - attackers can create arbitrary session cookies to impersonate any user, bypassing all authentication mechanisms.

Recommendation

Require EXPRESS_SESSION_SECRET to be set with a strong random value. Throw an error on startup if not configured. Use cryptographically strong random strings (minimum 256 bits).

Notes

The Express session secret defaults to the string 'flowise' when EXPRESS_SESSION_SECRET is not set (line 55). This secret is used to sign session cookies via express-session middleware. Since 'flowise' is publicly visible in the source code, an attacker can forge valid session cookies to impersonate any user without authentication. The .env.example file has this commented out (# EXPRESS_SESSION_SECRET=flowise), implying it's optional, which compounds the risk. Unlike development-only defaults, this code path is active in production if the environment variable is not set. The application should require EXPRESS_SESSION_SECRET to be explicitly configured with a cryptographically strong random value and fail to start otherwise.

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is high, an attacker needs administrative privileges on the target. A user must be tricked into taking some action. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability none.

Weakness class

CVE-2026-56278 is classified as CWE-798: Use of Hard-coded Credentials. Credentials are built into the product, so they are identical on every installation and cannot be rotated.

Affected software

CVE-2026-56278 is recorded against 1 package.

  • flowise

Timeline and source

Published on 16 April 2026 and last revised on 8 July 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
github.com (Package)

Details

Severity CRITICAL
CVSS Score 9.1
CVSS Vector CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
CWE CWE-798
Public Exploit ✅ No
Source OSV
Published 2026-04-16
Updated 2026-08-12
Modified 2026-07-08
Fix URL N/A

Affected Packages

Software From version Fixed in
flowise — —

Similar Threats

Exploit Protection

Are you running flowise?

CVE-2026-56278 carries CVSS 9.1 Critical rating. BotEraser checks your installation against this and other known CVE records, and blocks IPs associated with exploit activity.

Check My Site For CVE-2026-56278 →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.