[flowise] Flowise Missing Authentication on NVIDIA NIM Endpoints

**[flowise] Flowise Missing Authentication on NVIDIA NIM Endpoints**

Missing Authentication on NVIDIA NIM Endpoints Summary The NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. Vulnerability Details Field Value CWE CWE-306: Missing Authentication for Critical Function Affected File packages/server/src/utils/constants.ts Affected Line Line 20 ('/api/v1/nvidia-nim' in WHITELIST_URLS) CVSS 3.1 8.6 (High) Root Cause In packages/server/src/utils/constants.ts, the NVIDIA NIM route is added to the authentication whitelist: export const WHITELIST_URLS = [ // ... other URLs '/api/v1/nvidia-nim', // Line 20 - bypasses JWT/API-key validation // ... ] This causes the global auth middleware to skip authentication checks for all endpoints under /api/v1/nvidia-nim/*. None of the controller actions in packages/server/src/controllers/nvidia-nim/index.ts perform their own authentication checks...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.