CVE-2026-46440: FlowiseAI Exposes Basic Auth Credentials via API

May 14, 2026 (updated June 9, 2026)

Detection Method: Kolega.dev Deep Code Scan

Attribute	Value
Severity	Medium
CWE	CWE-522 (Insufficiently Protected Credentials)
Location	packages/server/src/enterprise/controllers/account.controller.ts:128-135
Practical Exploitability	Medium
Developer Approver	faizan@kolega.ai

References

github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2
github.com/FlowiseAI/Flowise/security/advisories/GHSA-php6-83fg-gw3g
github.com/advisories/GHSA-php6-83fg-gw3g
nvd.nist.gov/vuln/detail/CVE-2026-46440

Code Behaviors & Features

Detect and mitigate CVE-2026-46440 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →