Plaintext Authentication Without Rate Limiting in Flowise

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.

Casky was already ahead

This CVE exploits attack patterns that Casky's 215matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Flowise is a popular low-code platform for building LLM workflows through a visual interface. This vulnerability affects versions prior to 3.1.2 and stems from the checkBasicAuth endpoint validating credentials in plaintext without rate limiting or cryptographic protection. The flaw allows attackers to brute force authentication credentials with no throttling mechanism, making it trivial to gain unauthorized access to Flowise instances. Organizations using Flowise to orchestrate AI workflows—especially those handling sensitive data or business logic—face immediate risk of account compromise, lateral movement, and potential data exfiltration through the compromised LLM flow builder.

Casky's 215 mapped skills detect this vulnerability by analyzing authentication patterns against MITRE ATT&CK technique TA0006 (Credential Access). Claude AI's extended reasoning engine identifies hallmark attack indicators: repeated failed authentication attempts from single sources, plaintext credential transmission captured in logs, absence of rate-limiting headers in HTTP responses, and direct string comparison patterns in code analysis. A practitioner reviewing Casky findings would see flagged auth endpoint calls showing volumetric request spikes, absence of exponential backoff mechanisms, and basic auth headers transmitted without TLS pinning—collectively pointing to a brute-forceable authentication weakness. The skill set also correlates endpoint behavior with known credential stuffing and password spray tactics, enabling defenders to distinguish this CVE from other auth flaws and prioritize patching to version 3.1.2.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

215 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-46440.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

analyzing-office365-audit-logs-for-compromise

cloud security · low

Run

MITRE ATT&CK Techniques

TA0006

Investigate the attack patterns behind CVE-2026-46440

Casky has 215 skills that investigate the attack patterns behind CVE-2026-46440. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn