# CVE-2026-30824: Flowise - Authentication Bypass

> Live exploitation tracking for CVE-2026-30824 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-30824

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 7.7
- **Public exploit available:** Yes
- **Affected products:** FlowiseAI Flowise
- **Weaknesses:** CWE-306 (Missing Authentication for Critical Function)
- **Tags:** ai_mcp, web_application

## Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. This issue has been patched in version 3.0.13.

## CrowdSec analysis

[CVE-2026-30824](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-30824) is an authentication bypass vulnerability in Flowise prior to version 3.0.13, where the NVIDIA NIM router endpoints were improperly whitelisted, allowing unauthenticated users to access sensitive container management and token generation features. This flaw could be exploited by remote attackers to gain unauthorized control over privileged operations, posing significant security risks to affected deployments.

CrowdSec has been tracking this vulnerability and its exploits since 22nd of May 2026.

CrowdSec network observations suggest that most exploitation of CVE-2026-30824 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
CrowdSec network telemetry also shows that exploitation of CVE-2026-30824 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit unauthenticated access to endpoints under `/api/v1/nvidia-nim/`, such as `/api/v1/nvidia-nim/get-token`, to obtain privileged tokens or manage containers without authentication.

## Timeline

- 2026-03-07: CVE Published. CVE-2026-30824 is published to NVD.
- 2026-05-22: Rule Released. CrowdSec releases a rule to detect CVE-2026-30824 exploitation attempts against the CrowdSec Network.
- 2026-06-04: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-30824 for the first time.

## References

- https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5f53-522j-j454
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30824.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-30824) follows observed exploitation activity for CVE-2026-30824. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.