https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T01:01:00.261481+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-275112 EUVD-2026-275112 2026-10-08T01:01:00.264260+00:00 EUVD-2026-275112 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30824 fkie_cve-2026-30824 2026-10-08T01:01:00.264316+00:00

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. This issue has been patched in version 3.0.13.

 https://cve.radiocsirt.org/vuln/ghsa-5f53-522j-j454 GHSA-5f53-522j-j454 — Flowise Missing Authentication on NVIDIA NIM Endpoints 2026-10-08T01:01:00.264352+00:00

Affected: npm: flowise

# Missing Authentication on NVIDIA NIM Endpoints

## Summary

The NVIDIA NIM router (`/api/v1/nvidia-nim/*`) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints.

## Vulnerability Details

| Field | Value | |-------|-------| | CWE | CWE-306: Missing Authentication for Critical Function | | Affected File | `packages/server/src/utils/constants.ts` | | Affected Line | Line 20 (`'/api/v1/nvidia-nim'` in `WHITELIST_URLS`) | | CVSS 3.1 | 8.6 (High) |

## Root Cause

In `packages/server/src/utils/constants.ts`, the NVIDIA NIM route is added to the authentication whitelist:

```typescript export const WHITELIST_URLS = [ // ... other URLs '/api/v1/nvidia-nim', // Line 20 - bypasses JWT/API-key validation // ... ] ```

This causes the global auth middleware to skip authentication checks for all endpoints under `/api/v1/nvidia-nim/*`. None of the controller actions in `packages/server/src/controllers/nvidia-nim/index.ts` perform their own authentication checks.

## Affected Endpoints

| Method | Endpoint | Risk | |--------|----------|------| | GET | `/api/v1/nvidia-nim/get-token` | Leaks valid NVIDIA API token | | GET | `/api/v1/nvidia-nim/preload` | Resource consumption | | GET | `/api/v1/nvidia-nim/download-installer` | Resource consumption | | GET | `/api/v1/nvidia-nim/list-running-containers` | Information disclosure | | POST | `/api/v1/nvidia-nim/pull-image` | Arbitra…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0626 WID-SEC-W-2026-0626 — Flowise: Mehrere Schwachstellen 2026-10-08T01:01:00.264422+00:00

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.