CVE-2026-46440: Flowise: Basic Auth Credentials Exposed via API
Detection Method: Kolega.dev Deep Code Scan
| Attribute | Value | |---|---| | Severity | Medium | | CWE | CWE-522 (Insufficiently Protected Credentials) | | Location | packages/server/src/enterprise/controllers/account.controller.ts:128-135 | | Practical Exploitability | Medium | | Developer Approver | faizan@kolega.ai |
Description The checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison.
Affected Code public async checkBasicAuth(req: Request, res: Response) { const { username, password } = req.body if (username === process.env.FLOWISEUSERNAME && password === process.env.FLOWISEPASSWORD) { return res.json({ message: 'Authentication successful' })
Evidence Credentials are sent in plaintext in request body and compared directly without hashing. No rate limiting prevents brute force attacks. The endpoint returns different messages for success/failure, enabling enumeration.
Impact Credential brute-forcing - attackers can attempt unlimited username/password combinations against the basic auth system. Successful attacks grant access to the application.
Recommendation 1) Implement rate limiting on this endpoint, 2) Use constant-time comparison to prevent timing attacks, 3) Consider using hashed comparison, 4) Return generic error messages, 5) Add logging for failed attempts.
Notes The checkBasicAuth endpoint at line 128-135 has multiple security issues: (1) No rate limiting - the RateLimiterManager only applies to chatflow-specific endpoints, not auth endpoints. Attackers can perform unlimited brute force attempts. (2) Uses JavaScript === operator for comparison which is not constant-time, potentially enabling timing attacks. (3) Returns different messages for success ('Authentication successful') vs failure ('Authentication failed'), enabling credential enumeration. The endpoint compares plaintext credentials against environment variables FLOWISEUSERNAME and FLOWISEPASSWORD. While this is basic auth for simpler deployments, the lack of rate limiting makes it actively exploitable for credential brute-forcing.
Other sources
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/flowiseto a version that resolves this vulnerability.Fixed in 3.1.2 - Configuration
Implement rate limiting on the checkBasicAuth endpoint (e.g., apply a requests-per-minute limit per IP and/or per username) so brute-force attempts are throttled. Ensure the RateLimiterManager or equivalent is applied to auth endpoints, not only chatflow endpoints.
Flowise (packages/server/src/enterprise/controllers/account.controller.ts) rate_limiting = enabled - Configuration
Replace direct JavaScript === comparisons with a constant-time comparison function for credential checks to mitigate timing attacks (compare hashes in constant time rather than raw strings).
Flowise (packages/server/src/enterprise/controllers/account.controller.ts) comparison_method = constant-time comparison - Configuration
Avoid comparing plaintext credentials against environment variables; store and compare credentials using a secure hash (e.g., compare the stored hash to a hash of the provided password) instead of direct plaintext comparison.
Flowise (packages/server/src/enterprise/controllers/account.controller.ts) password_storage = hashed comparison - Configuration
Return a generic authentication failure message for both username and password failures (do not reveal whether username or password was incorrect) to prevent credential enumeration.
Flowise (packages/server/src/enterprise/controllers/account.controller.ts) error_message = generic error message - Configuration
Add logging for failed authentication attempts (include timestamp and source IP) and monitor/alert on suspicious patterns; ensure logs do not contain plaintext passwords.
Flowise (packages/server/src/enterprise/controllers/account.controller.ts) failed_login_logging = enabled
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs network access to the checkBasicAuth endpoint and user interaction is required according to the provided severity vector. No existing privileges are required.
Are credentials protected against repeated guessing attempts?
No. The endpoint has no rate limiting, allowing unlimited username and password attempts against the basic-auth system. Its distinct success and failure responses may also help attackers enumerate valid credentials.
What is the impact if an attacker successfully guesses the credentials?
A successful brute-force attack grants access to the application. The reported impact includes compromise of confidentiality, integrity, and availability.
What mitigation is identified if remediation is needed?
The provided recommendation calls for rate limiting on the authentication endpoint. The affected code also compares plaintext credentials directly, so credentials should not be handled or compared in plaintext.