CVE-2026-30824
CRITICAL NUCLEIFlowise < 3.0.13 - Unauthenticated Privileged Endpoint Access via NVIDIA NIM Router Whitelist
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2026-30824. PoCs published by dylvie. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains a functional Python exploit for CVE-2026-30824, an authentication bypass vulnerability in Flowise NVIDIA NIM. The exploit demonstrates unauthenticated access to critical endpoints, including token leakage and container management.
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. This issue has been patched in version 3.0.13.
Exploits (1)
The repository contains a functional Python exploit for CVE-2026-30824, an authentication bypass vulnerability in Flowise NVIDIA NIM. The exploit demonstrates unauthenticated access to critical endpoints, including token leakage and container management.
Nuclei Templates (1)
title:"Flowise"
title="Flowise"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H