4.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-56269

CVE-2026-56269: Flowise - Weak Default Token Hash Secret in JWT Token Encryption

Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKEN_HASH_SECRET environment variable in packages/server/src/enterprise/utils/tempTokenUtils.ts when the variable is not configured. This secret derives the AES-256-CBC key used to encrypt user IDs and workspace IDs in the 'meta' field of JWT tokens. An attacker who knows the default secret can decrypt this metadata to extract internal user and workspace identifiers, and re-encrypt manipulated values such as altered user or workspace IDs. Because the JWT signature is validated separately, decrypting or tampering with this metadata does not by itself grant access, but the disclosure of internal identifiers and possible metadata manipulation could aid privilege escalation or unauthorized data access.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-56269

CVE-2026-56269:

4.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
flowise	npm	<= 3.0.13	3.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the use of a weak, hardcoded default secret, 'Secre$t', for token encryption and decryption when the TOKEN_HASH_SECRET environment variable is not configured. This flaw is present in the encryptToken and decryptToken functions within packages/server/src/enterprise/utils/tempTokenUtils.ts. An attacker with knowledge of this default secret can decrypt the 'meta' field in JWTs, exposing internal identifiers like user and workspace IDs. While this does not grant immediate access, it provides valuable information for further attacks. The patch addresses this by removing the hardcoded default and implementing a robust secret management system. The new system, introduced in packages/server/src/enterprise/utils/authSecrets.ts, ensures that strong, unique secrets are used by default, retrieving them from environment variables, AWS Secrets Manager, or a local file, and explicitly checks against a list of known weak defaults. The functions encryptToken and decryptToken were modified to use this new secure secret retrieval mechanism, thus mitigating the vulnerability.

Vulnerable functions

encryptToken

packages/server/src/enterprise/utils/tempTokenUtils.ts

The function `encryptToken` uses a hardcoded and weak default secret 'Secre$t' to derive an encryption key when the `TOKEN_HASH_SECRET` environment variable is not set. This allows an attacker who knows the default secret to decrypt sensitive information from the tokens.

decryptToken

packages/server/src/enterprise/utils/tempTokenUtils.ts

The function `decryptToken` uses a hardcoded and weak default secret 'Secre$t' to derive a decryption key when the `TOKEN_HASH_SECRET` environment variable is not set. This allows an attacker who knows the default secret to decrypt and read sensitive metadata from JWT tokens, such as user and workspace IDs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.