CVE-2026-46440: Flowise: Basic Auth Credentials Exposed via API

Synopsis

An authentication-credential exposure vulnerability exists in the checkBasicAuth endpoint of Flowise, a drag-and-drop UI for building large language model workflows. The endpoint can be reached over the network without any prior authentication, but exploitation requires an attacker to engineer victim interaction and navigate moderate attack complexity. Successful exploitation gives an attacker full read, write, and availability impact on the affected service, including the ability to steal, modify, or destroy LLM flow data. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The checkBasicAuth endpoint is exposed over the network, so an attacker must be able to reach the Flowise service via a standard HTTP connection.

• AuthenticationNot required

  No credentials or prior account access are needed to reach the vulnerable endpoint and initiate an exploit attempt.

• Victim interactionRequired

  Exploitation requires a victim to take some action, such as following a crafted link or triggering a request, making a social-engineering step necessary.

• Attack complexityDetail

  The CVSS vector rates complexity as High, meaning the attacker must account for specific environmental conditions or timing factors beyond simple request crafting.

Blast Radius

• Reads plaintext Basic Auth credentials submitted to the checkBasicAuth endpoint, allowing the attacker to harvest valid usernames and passwords.
• Modifies LLM flow configurations, injecting malicious prompts or altering workflow logic stored in the Flowise instance.
• Crashes or degrades the Flowise service, disrupting LLM-powered applications that depend on it.
• Leverages captured credentials to pivot into connected systems if the same credentials are reused elsewhere.