CVE-2026-46440

CriticalCVSS 9.1/10Last modified Jul 23, 2026

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Jun 8, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-464419.6Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerabiCVE-2026-464429.9Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-fuCVE-2026-464436.5Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, when credentials are fetcheCVE-2026-464448.8Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, all CRUD endpoints for OpenCVE-2026-464457.1SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.CVE-2026-464467.1SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_passwCVE-2026-464477.7OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_infoCVE-2026-464488.5In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.CVE-2026-464496.7The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunCVE-2026-464525.3Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward applicationCVE-2026-464535.3Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The caCVE-2026-464549.8Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message h
CVE-2026-46440: Critical severity, CVSS 9.1 | Vulnix