Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Flowise allows unauthenticated access to NVIDIA NIM endpoints

CVE-2026-30824 · published 8 months ago
Summary

Versions of Flowise before 3.0.13 let anyone reach the NVIDIA NIM router URLs without logging in, exposing functions that control containers and generate tokens. This could let an attacker change how the service runs or obtain credentials. Update Flowise to version 3.0.13 or newer to close the gap.

What to do
  • Update flowiseai flowise to version 3.0.13.
Affected software
Ecosystem VendorProductAffected versions
npm flowiseai flowise <= 3.0.12
< 3.0.13
Fix: upgrade to 3.0.13
Original advisory text
Flowise: Missing Authentication on NVIDIA NIM Endpoints
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. This issue has been patched in version 3.0.13.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
37% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published7 Mar 2026
Updated2 Nov 2026
First seen6 Mar 2026
Sources
GHSA-5f53-522j-j454 · GHSA
CVE-2026-30824 · NVD
GHSA-5f53-522j-j454 · OSV
CVE-2026-30824 · OSV
Track software like this
Free during beta