Vulnerability · Published Aug 27, 2024 · Assigned by tenable
CVE-2024-8181Flowise Authentication Bypass
Critical 9.8
In plain English
A critical-severity improper authentication in Flowise from FlowiseAI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 45.1% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)45.1%top 1.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Nuclei
Official description
An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | flowise | no fix listed | GHSA-2q4w-x8h2-2fvh |
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H