PT-2026-23790 · Flowise+1 · Flowise+1
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Flowise versions prior to 3.0.13
Description
Flowise has an issue where the NVIDIA NIM router endpoint ('/api/v1/nvidia-nim/*') was incorrectly whitelisted in the global authentication middleware. This allowed unauthenticated access to sensitive container management and token generation endpoints. Specifically, the issue stems from a configuration in
packages/server/src/utils/constants.ts where the NVIDIA NIM route was added to the authentication whitelist, bypassing JWT/API-key validation. Affected endpoints include those for obtaining NVIDIA API tokens, managing container lifecycles (starting, stopping, pulling images), and retrieving container information. An attacker could exploit this to leak valid NVIDIA API tokens, manipulate container runtime, and potentially cause denial of service. The NVIDIA API token grants access to NVIDIA's inference API and can list over 170 large language models.Recommendations
Versions prior to 3.0.13 should be updated to version 3.0.13 or later.
Exploit
Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flowise
Nvidia Nim