CVE-2026-56272

Medium

Description

Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware, potentially compromising all user accounts in a database breach scenario.

SeverityMedium

CVSS4.1

Exploit probability—

ProductFlowise

PublishedJun 24, 2026

First seenJun 24, 2026

Weakness typeCWE-916CWE-916

How to fix

Update

flowiseai flowise3.0.13 or later
flowise3.0.13 or later

Vendor advisories

github.com/FlowiseAI/Flowise/security/advisories/GHSA-x2g5-fvc2-gqvp

Affected products

Product	Affected versions	Fixed in
flowiseai flowise	v < 3.0.13	3.0.13
flowisenpm	v < 3.0.13	3.0.13

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.