GHSA-m7mq-85xj-9x33: Flowise: Weak Default Token Hash Secret

April 16, 2026 (updated July 20, 2026)

Detection Method: Kolega.dev Deep Code Scan

Attribute	Value
Location	packages/server/src/enterprise/utils/tempTokenUtils.ts:31-34
Practical Exploitability	Medium
Developer Approver	faizan@kolega.ai

References

github.com/FlowiseAI/Flowise/security/advisories/GHSA-m7mq-85xj-9x33
github.com/advisories/GHSA-m7mq-85xj-9x33
nvd.nist.gov/vuln/detail/CVE-2026-56269
www.vulncheck.com/advisories/flowise-weak-default-token-hash-secret-in-jwt-token-encryption

Code Behaviors & Features

Detect and mitigate GHSA-m7mq-85xj-9x33 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →