CVE-2026-46440
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In Flowise prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This allows an attacker to perform a brute-force attack on passwords.
Risk Assessment
The risk for the organization is the potential takeover of user accounts via brute-force attacks, leading to unauthorized access to the LLM system.
Recommendation
Update Flowise to version 3.1.2 or later, which contains the fix.
Original NVD description (English source)
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.