GHSA-x2g5-fvc2-gqvp: Flowise has Insufficient Password Salt Rounds

March 5, 2026 (updated July 20, 2026)

The default bcrypt salt rounds is set to 5, which is below the recommended minimum for security.

References

github.com/FlowiseAI/Flowise/pull/5665
github.com/FlowiseAI/Flowise/security/advisories/GHSA-x2g5-fvc2-gqvp
github.com/advisories/GHSA-x2g5-fvc2-gqvp
nvd.nist.gov/vuln/detail/CVE-2026-56272
www.vulncheck.com/advisories/flowise-insufficient-password-salt-rounds-in-bcrypt-hashing

Code Behaviors & Features

Detect and mitigate GHSA-x2g5-fvc2-gqvp with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →