{"data":{"id":"01683808-a19f-4201-92e4-ecad7e3a61a4","title":"CVE-2026-46440: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the…","summary":"CVE-2026-46440 affects Flowise, a drag and drop interface for building customized large language model flows, prior to version 3.1.2. The checkBasicAuth endpoint validates credentials in plaintext, without rate limiting, using direct comparison, and is classified as CWE-522 (Insufficiently Protected Credentials). NVD had not yet provided an assessment at the time of publication.","solution":"This issue has been patched in version 3.1.2.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46440","publishedAt":"2026-06-08T16:16:41.043Z","cveId":"CVE-2026-46440","cweIds":["CWE-522"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.1 (fixed: 3.1.2)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Flowise checkBasicAuth validates plaintext creds without rate limiting","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00251,"epssCheckedAt":"2026-10-27T06:10:26.591Z","kevDateAdded":null,"advisoryAliases":["GHSA-php6-83fg-gw3g"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:47:49.544Z","patchAvailable":true,"disclosureDate":"2026-06-08T16:16:41.043Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}