CVE-2026-56277: Flowise wildcard CORS on TTS

CISO Take

Flowise versions before 3.1.2 hardcode Access-Control-Allow-Origin to a wildcard (*) on the text-to-speech generation endpoint, silently overriding the platform's otherwise restrictive default CORS policy. This means any external webpage a logged-in user visits can trigger cross-origin requests that invoke TTS generation using that user's stored credentials — a classic drive-by CSRF-style abuse pattern rather than a theoretical bug. There's no evidence of active exploitation (not in CISA KEV, no public exploit or Nuclei template found), and EPSS sits at a modest 0.0018, though that still places it in the top 92nd percentile of scored CVEs, meaning it's more likely to be weaponized than most vulnerabilities catalogued to date. The blast radius per-instance is what matters here — Flowise is a widely deployed low-code AI agent builder, and this is one of 114 CVEs tracked against the package, signaling a pattern of recurring hardening gaps rather than an isolated slip. Upgrade to Flowise 3.1.2 or later immediately, and until patched, front the TTS endpoint with a reverse proxy that enforces same-origin restrictions and audit any anomalous outbound TTS/API usage tied to stored credentials.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS vulncheck.com

What is the risk?

Low attack complexity and no privileges beyond an existing authenticated session are required — the attacker only needs to lure a logged-in Flowise user to a malicious webpage. Impact is bounded to the TTS feature but leverages stored third-party credentials (e.g., OpenAI or ElevenLabs API keys), so consequences extend to unauthorized API usage, cost harvesting, and possible exposure of generated audio content. Exploitation likelihood signals are mixed: EPSS is numerically low (0.00182) but ranks in the top 92% of scored CVEs, and there is no confirmed public exploit, scanner template, or KEV listing, so this is a plausible-but-not-yet-weaponized threat. Package-level risk is elevated by context — zero downstream dependents limits third-party blast radius, but 114 other CVEs against Flowise and an unscored OpenSSF posture point to weak security engineering discipline in the project overall.

How does the attack unfold?

Initial Access

An authenticated Flowise user visits an attacker-controlled webpage during normal browsing.

AML.T0078

Exploitation

The malicious page issues a cross-origin request to Flowise's TTS endpoint, which is accepted due to its hardcoded wildcard CORS policy.

AML.T0049

Credential Abuse

The request executes under the victim's session, triggering TTS generation using the victim's stored provider credentials without additional authorization.

AML.T0034

Impact

The attacker repeatedly forces costly TTS jobs and may retrieve generated audio output, causing financial and resource harm to the victim organization.

AML.T0048.000

Initial Access

An authenticated Flowise user visits an attacker-controlled webpage during normal browsing.

AML.T0078

Exploitation

The malicious page issues a cross-origin request to Flowise's TTS endpoint, which is accepted due to its hardcoded wildcard CORS policy.

AML.T0049

Credential Abuse

The request executes under the victim's session, triggering TTS generation using the victim's stored provider credentials without additional authorization.

AML.T0034

Impact

The attacker repeatedly forces costly TTS jobs and may retrieve generated audio output, causing financial and resource harm to the victim organization.

AML.T0048.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

Upgrade Flowise to version 3.1.2 or later, which removes the hardcoded wildcard and applies the server's configured getCorsOptions() consistently to the TTS controller. If immediate patching isn't possible, place a reverse proxy or WAF rule in front of the TTS endpoint (packages/server/src/controllers/text-to-speech) that rejects cross-origin Origin headers, and consider disabling the TTS feature until patched. Rotate any TTS provider API keys stored in Flowise credential stores as a precaution. For detection, monitor access logs for TTS endpoint requests carrying unexpected or non-instance Origin/Referer headers, and watch for unexplained spikes in TTS provider billing/usage as an indicator of abuse.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin API AML.T0034 - Cost Harvesting AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0078 - Drive-by Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system verification and validation

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-56277?

Flowise versions before 3.1.2 hardcode Access-Control-Allow-Origin to a wildcard (*) on the text-to-speech generation endpoint, silently overriding the platform's otherwise restrictive default CORS policy. This means any external webpage a logged-in user visits can trigger cross-origin requests that invoke TTS generation using that user's stored credentials — a classic drive-by CSRF-style abuse pattern rather than a theoretical bug. There's no evidence of active exploitation (not in CISA KEV, no public exploit or Nuclei template found), and EPSS sits at a modest 0.0018, though that still places it in the top 92nd percentile of scored CVEs, meaning it's more likely to be weaponized than most vulnerabilities catalogued to date. The blast radius per-instance is what matters here — Flowise is a widely deployed low-code AI agent builder, and this is one of 114 CVEs tracked against the package, signaling a pattern of recurring hardening gaps rather than an isolated slip. Upgrade to Flowise 3.1.2 or later immediately, and until patched, front the TTS endpoint with a reverse proxy that enforces same-origin restrictions and audit any anomalous outbound TTS/API usage tied to stored credentials.

Is CVE-2026-56277 actively exploited?

No confirmed active exploitation of CVE-2026-56277 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56277?

Upgrade Flowise to version 3.1.2 or later, which removes the hardcoded wildcard and applies the server's configured getCorsOptions() consistently to the TTS controller. If immediate patching isn't possible, place a reverse proxy or WAF rule in front of the TTS endpoint (packages/server/src/controllers/text-to-speech) that rejects cross-origin Origin headers, and consider disabling the TTS feature until patched. Rotate any TTS provider API keys stored in Flowise credential stores as a precaution. For detection, monitor access logs for TTS endpoint requests carrying unexpected or non-instance Origin/Referer headers, and watch for unexplained spikes in TTS provider billing/usage as an indicator of abuse.

What systems are affected by CVE-2026-56277?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code AI workflow builders, third-party API integrations (TTS/voice).

What is the CVSS score for CVE-2026-56277?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code AI workflow buildersthird-party API integrations (TTS/voice)

MITRE ATLAS Techniques

AML.T0034 Cost Harvesting

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0078 Drive-by Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation endpoint (packages/server/src/controllers/text-to-speech/index.ts), independent of the server's configured CORS policy. This bypasses the server's otherwise restrictive default CORS configuration (getCorsOptions()) and allows any webpage to make cross-origin requests that trigger TTS generation using stored credentials, enabling drive-by cross-origin credential abuse.

Exploitation Scenario

An attacker sets up a webpage containing JavaScript that issues a cross-origin request to a target organization's Flowise instance TTS endpoint. A Flowise user with an active session (e.g., an employee who has the app open in another tab) visits that page during normal browsing. Because the endpoint always returns Access-Control-Allow-Origin: *, the browser permits the request to succeed regardless of the victim instance's real CORS policy, and the request executes using the victim's already-authenticated session and stored TTS provider credentials. The attacker can repeatedly trigger TTS generation jobs at will, running up API costs against the victim's credentials and potentially retrieving generated audio output without ever needing valid Flowise credentials of their own.