Missing Authentication for Critical Function in Flowise - CVE-2026-30824
Published: April 9, 2026 / Updated: April 30, 2026
Vulnerability identifier: #VU125527
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-30824
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information in a subsequent system.
The vulnerability exists due to missing authentication for critical function in the NVIDIA NIM endpoints when handling requests to /api/v1/nvidia-nim/*. A remote attacker can send crafted requests to obtain a valid NVIDIA API token and disclose sensitive information in a subsequent system.
On systems with Docker or NIM installed, additional unauthenticated endpoint access may allow container enumeration, image pulls, container starts, or service disruption.
Affected software
Flowise
How to mitigate CVE-2026-30824
Install security update from vendor's website.
Flowise - update to 3.0.13