CVE-2026-46440

critical · 9.1

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.

9.1

CVSS

0.3%

EPSS (exploit prob.)

17th

EPSS percentile

2026-06-08

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-522

Affected products

Vendor	Product	Affected versions
flowiseai	flowise	< 3.1.2

Check a specific version with /api/v1/cve/match.

References

https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-php6-83fg-gw3g
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-php6-83fg-gw3g

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-46440