CVE-2026-6589

Name of the Vulnerable Software and Affected Versions ComfyUI versions prior to 0.13.1

Description A cross-site request forgery issue exists in the create origin only middleware() function within the server.py file. This flaw allows a remote attacker to initiate unauthorized requests by manipulating the application.

Recommendations Update to a version later than 0.13.0. As a temporary workaround, consider restricting access to the create origin only middleware() function until a patch is applied.