CVE-2026-46440

CVE-2026-46440 · Flowise: Basic Auth Credentials Exposed via API

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.

CVSS 7.5 · High · EPSS 0.3% · Fix available

Published: 2026-06-08T15:29:40.724Z
Updated: 2026-06-08T19:18:43.370Z

Stack: node

Affected products and versions

flowise
Versions
- < 3.1.2: Affected
No fix published
flowise npm
Affected ranges
- SEMVER: < 3.1.2
Update to 3.1.2

Original sources

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-php6-83fg-gw3g
https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2
https://nvd.nist.gov/vuln/detail/CVE-2026-46440

Check your server →

CVE-2026-46440 · Flowise: Basic Auth Credentials Exposed via API

Affected products and versions

flowise

flowise npm

Original sources