Thanks for your response. As wm.server.globalvariables is of WMRoot package, we cannot completely rely on that.
I found the below solution for this–
I enabled the internal passwords access from IS to the Designer Flow service by setting watt.security.ope.AllowInternalPasswordAccess to true, and used the pub.security.outboundPasswords:getPassword to retrieve the Global variable password directly instead of globalVariable substitution.