CVE-2026-46440 HIGH

CVE-2026-46440: Flowise: Basic Auth Credentials Exposed via API

Vendor Flowiseai
Product Flowise
Weakness CWE-522 · Insufficiently protected credentials
Published June 8, 2026
Last update June 8, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.

Key dates

02Disclosure timeline

June 8, 2026 CVE published
June 8, 2026 Record updated