EUVD-2026-40432
GHSA-8m62-6r3h-3x25
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Drive-by CORS abuse requires victim to visit a malicious page (UI:R); attacker needs no credentials (PR:N); impact is low-severity TTS generation abuse with no availability or scope-change component.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation endpoint (packages/server/src/controllers/text-to-speech/index.ts), independent of the server's configured CORS policy. This bypasses the server's otherwise restrictive default CORS configuration (getCorsOptions()) and allows any webpage to make cross-origin requests that trigger TTS generation using stored credentials, enabling drive-by cross-origin credential abuse.
AnalysisAI
Cross-origin request forgery via a hardcoded CORS wildcard in Flowise's text-to-speech endpoint (versions before 3.1.2) allows any malicious webpage to trigger TTS generation using a victim's stored credentials. The controller file packages/server/src/controllers/text-to-speech/index.ts unconditionally sets Access-Control-Allow-Origin: *, directly overriding the server's restrictive getCorsOptions() CORS policy for that route. No public exploit is identified at time of analysis, but the attack requires only basic web scripting skill given the straightforward CORS bypass mechanism.
Technical ContextAI
Flowise is an open-source LLM orchestration and AI workflow builder (CPE: cpe:2.3:a:flowise:flowise:*:*:*:*:*:*:*:*). The root cause maps to CWE-346 (Origin Validation Error): the server establishes a restrictive CORS policy through a central getCorsOptions() function, but the TTS route controller bypasses this by independently injecting Access-Control-Allow-Origin: * as a hardcoded response header. CORS is a browser-enforced security boundary; a wildcard origin value instructs browsers that any origin may issue and read responses from the endpoint. When a malicious page calls fetch() against the Flowise TTS endpoint, the browser's same-origin policy is nullified for that route. The defect is a single-route configuration override that escapes the server-wide middleware chain, rather than a flaw in the CORS library itself.
RemediationAI
Upgrade Flowise to version 3.1.2 or later, which aligns the TTS endpoint's CORS handling with the server-wide getCorsOptions() policy, eliminating the hardcoded wildcard. The vendor advisory is at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-m837-xvxr-vqwg. If immediate upgrade is not feasible, placing a reverse proxy (e.g., nginx) in front of Flowise that strips or overrides the Access-Control-Allow-Origin header on /api/v1/text-to-speech responses can serve as a temporary compensating control, though this does not fix the root cause and must be validated per deployment. Restricting Flowise to internal or VPN-only network access eliminates the cross-origin threat for deployments that do not require public internet exposure. If TTS functionality is not in use, disabling or blocking the endpoint entirely at the proxy or firewall layer is a clean workaround with no functional trade-off for those deployments.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Privilege escalation in Flowise versions prior to 3.0.13 allows authenticated users to bypass API authorization by spoof
Flowise versions up to 3.0.13 is affected by authorization bypass through user-controlled key (CVSS 8.8).
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today