CVE-2026-56277: Flowise - Hardcoded CORS Wildcard in TTS Endpoint
Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard () on its text-to-speech (TTS) generation endpoint (packages/server/src/controllers/text-to-speech/index.ts), independent of the server's configured CORS policy. This bypasses the server's otherwise restrictive default CORS configuration (getCorsOptions()) and allows any webpage to make cross-origin requests that trigger TTS generation using stored credentials, enabling drive-by cross-origin credential abuse.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.1.2 - Configuration
Update Flowise so the TTS endpoint no longer sets a hardcoded Access-Control-Allow-Origin: * and instead follows the server's configured CORS options returned by getCorsOptions().
Flowise text-to-speech (TTS) generation endpoint (packages/server/src/controllers/text-to-speech/index.ts) Access-Control-Allow-Origin = (remove hardcoded '*', use server-configured CORS policy via getCorsOptions())
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56277?
CVE-2026-56277 has a medium severity rating of 6.9.
How does CVE-2026-56277 affect Flowise?
CVE-2026-56277 allows unauthorized access to the text-to-speech generation endpoint due to a hardcoded CORS wildcard, potentially exposing sensitive data.
What versions of Flowise are affected by CVE-2026-56277?
CVE-2026-56277 affects Flowise versions before 3.1.2.
How can I fix CVE-2026-56277?
To resolve CVE-2026-56277, update Flowise to version 3.1.2 or later to eliminate the hardcoded CORS wildcard.
What is the potential impact of CVE-2026-56277?
The potential impact of CVE-2026-56277 includes cross-origin resource sharing vulnerabilities that can lead to unauthorized data access.