CVE-2026-41266 is an information exposure vulnerability in FlowiseAI Flowise before version 3.1.0. The issue exists because the /api/v1/public-chatbotConfig/:id endpoint returns sensitive data including API keys and HTTP authorization headers without any authentication or access control. Attackers with knowledge of a chatflow UUID can retrieve these credentials, leading to unauthorized access and potential further compromise. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information), CWE-522 (Insufficiently Protected Credentials), and CWE-862 (Missing Authorization). The vulnerability is resolved in Flowise version 3.1.0.

Exploitation allows unauthorized actors to obtain sensitive credentials such as API keys and HTTP authorization headers, which can lead to credential theft and potentially unauthorized access to systems or services relying on those credentials. This exposure can compromise the confidentiality and integrity of the affected environment. There are no known exploits in the wild as of the published date.

Upgrade Flowise to version 3.1.0 or later, where this vulnerability is fixed. Since the vulnerability is resolved in the newer version, applying this official fix is the recommended remediation. No other vendor advisory or patch information is provided, so check the vendor's official channels for any additional guidance.