Executive brief
Flowise is a visual AI agent builder that includes container management and API integration features. The NVIDIA NIM endpoints are incorrectly whitelisted in the authentication middleware, allowing unauthenticated attackers to retrieve valid NVIDIA API tokens, manipulate Docker containers, and perform privileged operations without any credentials. This could lead to credential theft, service disruption, and potential execution of malicious container images.
Technical details
This is a missing authentication vulnerability (CWE-306) in Flowise affecting the NVIDIA NIM router endpoints under /api/v1/nvidia-nim/*. The root cause is that this route is added to WHITELIST_URLS in packages/server/src/utils/constants.ts (line 20), causing the global auth middleware to skip authentication checks. The affected endpoints lack their own authentication mechanisms in packages/server/src/controllers/nvidia-nim/index.ts. Unauthenticated attackers can call GET /api/v1/nvidia-nim/get-token to leak valid NVIDIA API tokens (granting access to 170+ LLM models), list and stop containers via POST methods, pull arbitrary Docker images, and perform reconnaissance. The vulnerability is network-reachable and requires no authentication or user interaction. A patch is available in version 3.0.13; all previous versions (≤3.0.12) are affected.
Affected products
- FlowiseAI Flowise <=3.0.12
Timeline
- 2026-03-06: disclosed
- 2026-03-02: patched: Version 3.0.13 released with fix