CVE-2026-8026: Flowise: Bcrypt Password Hash Exposure

May 6, 2026 (updated May 12, 2026)

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.

References

gist.github.com/YLChen-007/50a553f09aa1c7c04ce18cec13986a91
github.com/advisories/GHSA-8f47-4rh3-x44m
nvd.nist.gov/vuln/detail/CVE-2026-8026
vuldb.com/submit/777656
vuldb.com/vuln/361273
vuldb.com/vuln/361273/cti

Code Behaviors & Features

Detect and mitigate CVE-2026-8026 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →