CVE-2026-56272

Katalog CVE

CVSS 4.1 · Medium EPSS 0,10%

Kerentanan Use of Password Hash With Insufficient Computational Effort pada flowiseai flowise. Skor CVSS 3.1 4.1 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware, potentially compromising all user accounts in a database breach scenario.

Rincian

Terbit di NVD

24 Juni 2026

Terakhir diubah

26 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.1 (Medium), sumber vulncheck.com
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-916: Use of Password Hash With Insufficient Computational Effort

EPSS (30 hari)

0,10% peluang dieksploitasi; lebih tinggi dari 0,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x2g5-fvc2-gqvp mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/flowise-insufficient-password-salt-rounds-in-bcrypt-hashing advisory pihak ketiga