What is CVE-2026-46440?

CVE-2026-46440 is a critical-severity vulnerability in Flowiseai Flowise, classified under Insufficiently Protected Credentials. CVSS score: 9.1/10. Published 2026-06-08.

How severe is CVE-2026-46440?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Flowiseai Flowise

CVE-2026-46440

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.

EPSS: 0.003 (16.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Flowiseai Flowise — versions < 3.1.2

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

security-advisories@github.com (Product, x_refsource_MISC, Release Notes)
security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-46440?: CVE-2026-46440 is a critical-severity vulnerability in Flowiseai Flowise, classified under Insufficiently Protected Credentials. CVSS score: 9.1/10. Published 2026-06-08.
How severe is CVE-2026-46440?: Critical severity. CVSS v3 base score is 9.1 out of 10.