Loading vulnerability…
CVE-2026-30824 affects Flowise, a drag-and-drop interface for building customized large language model flows. In Flowise versions prior to 3.0.13, the NVIDIA NIM router path (/api/v1/nvidia-nim/*) was incorrectly whitelisted in the global authentication middleware. As a result, requests to these endpoints bypass authentication checks and can be accessed without valid credentials. The exposed functionality includes privileged container management and token generation endpoints, creating an authentication bypass condition on sensitive administrative functionality.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a single Python exploit script and a README. The script targets CVE-2026-30824, an authentication bypass in Flowise affecting versions prior to 3.0.13, where /api/v1/nvidia-nim/* endpoints are incorrectly exempted from authentication. The exploit is a standalone Python tool built with requests, argparse, json, and urllib.parse.urljoin. It supports single-target and batch-target operation, performs a vulnerability check by probing GET /api/v1/nvidia-nim/get-token, and treats non-401/non-404 accessible responses as evidence of exposure. Beyond detection, it can leak NVIDIA API tokens, enumerate running NIM containers, and—based on the CLI and README—retrieve container/image details, pull images, start containers, stop containers, and run a preload/full recon workflow. The script also includes optional validation of a leaked token against NVIDIA API services to demonstrate blast radius. This is not merely a detector: it includes post-bypass operational actions against container-management functionality, making it an operational exploit/abuse tool rather than a simple scanner. The repository structure is minimal: CVE-2026-30824.py is the main executable entry point and README.md documents vulnerability background, usage examples, command-line options, mitigation guidance, and references.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.