{"id":"CVE-2026-46440","aliases":["EUVD-2026-35107","GHSA-php6-83fg-gw3g"],"status":"published","title":"Flowise: Basic Auth Credentials Exposed via API","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00231,"percentile":0.14038,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-522"],"published":"2026-05-14T14:54:46Z","modified":"2026-10-28T02:30:34Z","fixes":[{"ecosystem":"npm","package":"flowise","fixed_in":["3.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"flowise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.1"},{"fixed":"3.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"flowise","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.2"}]}]}],"products":[{"vendor":"flowiseai","product":"flowise"}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-php6-83fg-gw3g","tags":["x_refsource_CONFIRM","exploit","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46440","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-php6-83fg-gw3g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46440.json","tags":["advisory"]},{"url":"https://github.com/FlowiseAI/Flowise","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-46440","title":"Flowise: Basic Auth Credentials Exposed via API","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.","status":"published","published":"2026-06-08T15:29:40.724Z","modified":"2026-06-08T19:18:43.37Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T13:47:06.353366Z"}],"euvd":[{"id":"EUVD-2026-35107","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.","status":"published","published":"2026-06-08T15:29:40Z","modified":"2026-06-08T19:18:43Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:48.375828Z"}],"ghsa":[{"id":"GHSA-php6-83fg-gw3g","title":"FlowiseAI Exposes Basic Auth Credentials via API","description":"**Detection Method:** Kolega.dev Deep Code Scan\n\n| Attribute | Value |\n|---|---|\n| Severity | Medium |\n| CWE | CWE-522 (Insufficiently Protected Credentials) |\n| Location | packages/server/src/enterprise/controllers/account.controller.ts:128-135 |\n| Practical Exploitability | Medium |\n| Developer Approver | faizan@kolega.ai |\n\n### Description\nThe checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison.\n\n### Affected Code\n```\npublic async checkBasicAuth(req: Request, res: Response) {\n    const { username, password } = req.body\n    if (username === process.env.FLOWISE_USERNAME \u0026\u0026 password === process.env.FLOWISE_PASSWORD) {\n        return res.json({ message: 'Authentication successful' })\n```\n\n### Evidence\nCredentials are sent in plaintext in request body and compared directly without hashing. No rate limiting prevents brute force attacks. The endpoint returns different messages for success/failure, enabling enumeration.\n\n### Impact\nCredential brute-forcing - attackers can attempt unlimited username/password combinations against the basic auth system. Successful attacks grant access to the application.\n\n### Recommendation\n1) Implement rate limiting on this endpoint, 2) Use constant-time comparison to prevent timing attacks, 3) Consider using hashed comparison, 4) Return generic error messages, 5) Add logging for failed attempts.\n\n### Notes\nThe checkBasicAuth endpoint at line 128-135 has multiple security issues: (1) No rate limiting - the RateLimiterManager only applies to chatflow-specific endpoints, not auth endpoints. Attackers can perform unlimited brute force attempts. (2) Uses JavaScript === operator for comparison which is not constant-time, potentially enabling timing attacks. (3) Returns different messages for success ('Authentication successful') vs failure ('Authentication failed'), enabling credential enumeration. The endpoint compares plaintext credentials against environment variables FLOWISE_USERNAME and FLOWISE_PASSWORD. While this is basic auth for simpler deployments, the lack of rate limiting makes it actively exploitable for credential brute-forcing.","status":"published","published":"2026-05-14T14:54:46Z","modified":"2026-06-09T13:10:10Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:40:24.856614Z"}],"nvd":[{"id":"CVE-2026-46440","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.","status":"published","published":"2026-06-08T16:16:41.043Z","modified":"2026-07-23T07:10:00.113Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:12:22.73178Z"}],"osv":[{"id":"CVE-2026-46440","title":"Flowise: Basic Auth Credentials Exposed via API","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.","status":"published","published":"2026-06-08T15:29:40.724Z","modified":"2026-10-28T02:30:34.051859605Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:45:05.870292Z"},{"id":"GHSA-php6-83fg-gw3g","title":"FlowiseAI Exposes Basic Auth Credentials via API","description":"**Detection Method:** Kolega.dev Deep Code Scan\n\n| Attribute | Value |\n|---|---|\n| Severity | Medium |\n| CWE | CWE-522 (Insufficiently Protected Credentials) |\n| Location | packages/server/src/enterprise/controllers/account.controller.ts:128-135 |\n| Practical Exploitability | Medium |\n| Developer Approver | faizan@kolega.ai |\n\n### Description\nThe checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison.\n\n### Affected Code\n```\npublic async checkBasicAuth(req: Request, res: Response) {\n    const { username, password } = req.body\n    if (username === process.env.FLOWISE_USERNAME \u0026\u0026 password === process.env.FLOWISE_PASSWORD) {\n        return res.json({ message: 'Authentication successful' })\n```\n\n### Evidence\nCredentials are sent in plaintext in request body and compared directly without hashing. No rate limiting prevents brute force attacks. The endpoint returns different messages for success/failure, enabling enumeration.\n\n### Impact\nCredential brute-forcing - attackers can attempt unlimited username/password combinations against the basic auth system. Successful attacks grant access to the application.\n\n### Recommendation\n1) Implement rate limiting on this endpoint, 2) Use constant-time comparison to prevent timing attacks, 3) Consider using hashed comparison, 4) Return generic error messages, 5) Add logging for failed attempts.\n\n### Notes\nThe checkBasicAuth endpoint at line 128-135 has multiple security issues: (1) No rate limiting - the RateLimiterManager only applies to chatflow-specific endpoints, not auth endpoints. Attackers can perform unlimited brute force attempts. (2) Uses JavaScript === operator for comparison which is not constant-time, potentially enabling timing attacks. (3) Returns different messages for success ('Authentication successful') vs failure ('Authentication failed'), enabling credential enumeration. The endpoint compares plaintext credentials against environment variables FLOWISE_USERNAME and FLOWISE_PASSWORD. While this is basic auth for simpler deployments, the lack of rate limiting makes it actively exploitable for credential brute-forcing.","status":"published","published":"2026-05-14T14:54:46Z","modified":"2026-06-09T13:15:14.363089668Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:46:53.244788Z"}]}}