CVE-2026-8028: Information disclosure vulnerability in FlowiseAI Flowise
Flowise
An information disclosure vulnerability exists in FlowiseAI Flowise up to 3.0.12 within the account service verification function. Remote exploitation can lead to sensitive information disclosure, and upgrading is recommended.
disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why
- CVSS
- 3.7
- EPSS
- <0.01 · top 66% · 2026-11-13
- fix status
- Fix status unknown
- first report
- 6 May 2026
- last update
- 6 May 2026
- CVE ids
Timeline · 1
Sources · 1
Advisories and databases
- 2026-05-06CVE-2026-8028: A vulnerability was detected in FlowiseAI Flowise up to 3.0.12.NVD · nvd.nist.gov/vuln/detail/CVE-2026-8028
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Patch now
- AI role
- Attack on AI
- categories
- Infrastructure vulnerabilityData leak
- severity
- 2 · Disclosed vulnerability
- fix status
- Fix status unknown
- targets
- Framework / tooling
- mitre atlas
- no technique for these categories
- dates
- happened 6 May 2026 · first reported 6 May 2026
- origin
- NVDVulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- record
- confidence 0.95 · created 2026-10-18 10:04Z · updated 2026-10-18 10:04Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# CVE-2026-8028: Information disclosure vulnerability in FlowiseAI Flowise https://gcdradar.vercel.app/incidents/cve-2026-8028-information-disclosure-vulnerability-in-flowis · AIR-2026-1067 · closed 2026-05-06 - Lane: Patch now - Severity: 2 (Disclosed vulnerability) - Fix status: Fix status unknown - First reported: 2026-05-06 - AI role: Attack on AI - Products: Flowise - CVE ids: CVE-2026-8028 - CVSS: 3.7 ## Summary An information disclosure vulnerability exists in FlowiseAI Flowise up to 3.0.12 within the account service verification function. Remote exploitation can lead to sensitive information disclosure, and upgrading is recommended. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-05-06: CVE-2026-8028: A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. (https://nvd.nist.gov/vuln/detail/CVE-2026-8028) ## Sources - 2026-05-06 NVD: CVE-2026-8028: A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. https://nvd.nist.gov/vuln/detail/CVE-2026-8028 Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closed7.7Flowise CVE-2026-56268: Flowise cross-workspace chatflow information disclosure
Patch now · Disclosed · since 20 May 2026 · updated 22 Jun 2026 · CVE-2026-56268
AI - closed8.7Flowise CVE-2026-41278: Flowise Public Endpoints Expose Plaintext API Keys
Patch now · Disclosed · since 17 Apr 2026 · updated 23 Apr 2026 · CVE-2026-41278
AI - closed5.3Flowise CVE-2026-56270: Flowise Unauthenticated Information Disclosure of OAuth Secrets
Patch now · Disclosed · since 16 Apr 2026 · updated 24 Jun 2026 · CVE-2026-56270
AI - closed7.7Flowise CVE-2026-41266: Flowise Sensitive Data Leak in Chatbot Config
Patch now · Disclosed · since 16 Apr 2026 · updated 23 Apr 2026 · CVE-2026-41266
AI - closed8.2Flowise CVE-2026-41273: Flowise OAuth 2.0 Access Token Disclosure
Patch now · Disclosed · since 16 Apr 2026 · updated 23 Apr 2026 · CVE-2026-41273
AI - closed7.1Flowise CVE-2026-73604: Incomplete credential redaction in Flowise API
Patch now · Disclosed · since 13 Aug 2026 · CVE-2026-73604
AI