CVE-2026-6589: ComfyUI server.py create_origin_only_middleware cross-site request forgery
A security vulnerability has been detected in ComfyUI up to 0.13.0. This affects the function createoriginonlymiddleware of the file server.py. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6589?
CVE-2026-6589 is classified as a critical cross-site request forgery vulnerability in ComfyUI.
How do I fix CVE-2026-6589?
To address CVE-2026-6589, upgrade ComfyUI to version 0.14.0 or later where the vulnerability is patched.
What systems are affected by CVE-2026-6589?
CVE-2026-6589 affects ComfyUI versions up to 0.13.0.
What are the risks of CVE-2026-6589?
Exploitation of CVE-2026-6589 can allow attackers to perform unauthorized actions on behalf of users.
Is CVE-2026-6589 actively being exploited?
While there have been reports of CVE-2026-6589 being targeted, specific active exploits may vary.