CVE-2026-73604 describes an incomplete credential redaction vulnerability in Flowise prior to version 3.1.3. The GET /api/v1/credentials/:id API endpoint returns decrypted secrets in plaintext to authenticated users who have the credentials:view permission. This exposure includes sensitive data such as database connection URLs containing passwords, cloud service account JSON files with private keys, and API keys. The vulnerability arises from insufficient redaction of sensitive information in the API response.

Authenticated users with credentials:view permission can access sensitive secrets in plaintext, potentially leading to unauthorized access to databases, cloud services, and APIs if those credentials are misused. This exposure increases the risk of data breaches or privilege escalation within environments using affected Flowise versions.

A fixed version 3.1.3 or later should be applied to remediate this vulnerability. Since no official patch or remediation level is provided in the vendor advisory, users should upgrade to Flowise 3.1.3 or later where this issue is resolved. Until then, restrict credentials:view permissions to trusted users only.