CVE-2026-30824 Details

A vulnerability in Flowise prior to version 3.0.13 allows unauthenticated access to privileged container management and token generation endpoints via the NVIDIA NIM router. This is due to the router being whitelisted in the global authentication middleware, which bypasses authentication checks for all endpoints under '/api/v1/nvidia-nim/*'. As a result, unauthorized users can access sensitive functionalities such as managing containers and generating tokens for NVIDIA's inference API.

Users are advised to update Flowise to version 3.0.13 or later, where this vulnerability has been patched.