CVE-2026-30824CWE-306

Flowise: Missing Authentication on NVIDIA NIM Endpoints

High · published March 7, 2026

CVSS v4.0
7.7
EPSS
3%
Percentile
85.4
In the wild
Unconfirmed
What it is

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. This issue has been patched in version 3.0.13.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.02638 · 85.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-03-07T05:11Z
EPSS history
Timeline
  • 25 SEP 03:25Z
    EPSS moved 36% → 3%
    epss
  • 07 MAR 05:11Z
    Flowise: Missing Authentication on NVIDIA NIM Endpoints
    cvelistv5