5.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-56272

CVE-2026-56272: Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing

Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware, potentially compromising all user accounts in a database breach scenario.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-56272

CVE-2026-56272:

5.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
flowise	npm	<= 3.0.12	3.0.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the use of an insufficient number of salt rounds (5) with bcrypt for password hashing, which is below the OWASP recommendation of at least 10. This weakness makes stored password hashes more susceptible to offline brute-force attacks. The analysis of the provided pull request and commits confirms this. The commit 4f79b4cc2613fcbb91d241b234ea6d74e7ba9462 directly addresses the issue by changing the default salt rounds from '5' to '10' in two key locations. The first is the centralized getHash function in encryption.util.ts, which is used for creating new user accounts. The second is within the resetPassword method in account.service.ts, which handled password resets. Subsequent commits introduced a mechanism within the login function to automatically upgrade the hashes of existing users to the stronger standard upon a successful login. Therefore, the primary vulnerable functions are getHash and AccountService.resetPassword as they were responsible for generating the weak hashes. The AccountService.login function is also a relevant runtime indicator as it's involved in processing and mitigating these weak hashes.

Vulnerable functions

getHash

packages/server/src/enterprise/utils/encryption.util.ts

This function was used to hash passwords and used a default of 5 salt rounds for bcrypt, which is computationally insufficient and makes the resulting hashes easier to crack. The patch increased the default to 10.

AccountService.resetPassword

packages/server/src/enterprise/services/account.service.ts

This method contained its own logic for hashing a new password during a password reset. It also used the weak default of 5 salt rounds for bcrypt, creating an insecure password hash. The patch increased the default to 10.

AccountService.login

packages/server/src/enterprise/services/account.service.ts

While not directly creating the vulnerable hash, this function processes the weakly hashed password during login. The patch modified this function to detect and upgrade hashes with insufficient salt rounds, making it a key runtime indicator for systems with existing vulnerable password hashes.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.