CVE-2026-56277

Description

### Summary The TTS generation endpoint sets `Access-Control-Allow-Origin: *` as a hardcoded response header, independent of the server's CORS configuration. This enables any webpage to make cross-origin requests to generate speech using stored credentials. ### Root Cause ```typescript // packages/server/src/controllers/text-to-speech/index.ts:83 res.setHeader('Access-Control-Allow-Origin', '*') res.setHeader('Access-Control-Allow-Headers', 'Cache-Control') ``` ### Impact - Cross-origin credential abuse — any webpage can trigger TTS using stored credentials - Bypasses the server's CORS policy (`getCorsOptions()`) which is otherwise restrictive by default - Combined with Finding 3 (TTS credential abuse), enables drive-by credential abuse via malicious webpages ### Suggested Fix Remove the hardcoded CORS wildcard and let the server's CORS middleware handle the headers: ```typescript // Remove these lines: // res.setHeader('Access-Control-Allow-Origin', '*') // res.setHeader('Access-Control-Allow-Headers', 'Cache-Control') ``` --- ## References - `packages/server/src/controllers/text-to-speech/index.ts` line 83

How to fix CVE-2026-56277

To remediate CVE-2026-56277, upgrade the affected package to a fixed version below.

• —upgrade to 3.1.2 or later

Is CVE-2026-56277 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 3.1.2

CVSS scores

References (2)

• PATCHgithub.com/FlowiseAI/Flowise
• WEBgithub.com/FlowiseAI/Flowise/security/advisories/GHSA-m837-xvxr-vqwg