Flowise: FlowiseAI Exposes Basic Auth Credentials via API
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Critical, CVSS 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Record
- CVE-2026-46440
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 8, 2026
- Source last modified
- July 23, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.
Description quoted from the NVD record.
Who is affected
Your organization is affected if it uses Flowise, a drag-and-drop tool for building apps that use AI language models. This flaw affects all versions before 3.1.2. The problem is in the part of the product that checks the basic username and password login. It compares the login details as plain readable text and does not limit how many attempts someone can make, which can expose the basic login details that protect your Flowise. This flaw is rated Critical.
What to do
- Decide who should act. If you or someone on your staff installed and runs Flowise, that person should handle this. If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update will be done.
- Check which version of Flowise your organization runs. Any version before
3.1.2has this flaw. - Update Flowise to version
3.1.2or later, which fixes this flaw. - If you are not sure whether your organization uses Flowise at all, ask the person who looks after your computers or online tools.
Analysis written from the source record as of July 23, 2026 and reviewed before publishing.