CVE-2026-6589: ComfyUI CSRF Vulnerability in server.py

CVE-2026-6589 Overview

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ComfyUI up to version 0.13.0. This security flaw exists within the create_origin_only_middleware function located in the server.py file. The vulnerability allows remote attackers to manipulate application state by tricking authenticated users into executing unintended actions. The exploit has been publicly disclosed, and despite early vendor notification, no response was received regarding this disclosure.

Critical Impact

Remote attackers can forge requests on behalf of authenticated users, potentially leading to unauthorized state changes, data manipulation, or execution of privileged actions within ComfyUI workflows.

Affected Products

• ComfyUI versions up to and including 0.13.0

Discovery Timeline

• 2026-04-20 - CVE CVE-2026-6589 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-6589

Vulnerability Analysis

This vulnerability is classified as Cross-Site Request Forgery (CWE-352), a web application security flaw that occurs when an application fails to properly validate that requests originate from trusted sources. In ComfyUI, the create_origin_only_middleware function in server.py is designed to restrict requests based on their origin, but the implementation contains a flaw that allows attackers to bypass this protection.

The vulnerability requires user interaction—specifically, a victim must be tricked into visiting a malicious webpage or clicking a crafted link while authenticated to a ComfyUI instance. Since ComfyUI is commonly used for AI image generation workflows, successful exploitation could allow attackers to manipulate workflows, queue malicious generation tasks, or potentially access sensitive configuration data.

Root Cause

The root cause of this vulnerability lies in improper origin validation within the middleware implementation. The create_origin_only_middleware function fails to adequately verify the source of incoming requests, allowing cross-origin requests to bypass intended security controls. This represents a failure in implementing proper CSRF token validation or insufficient origin header verification.

Attack Vector

The attack is network-based and can be initiated remotely. An attacker constructs a malicious webpage containing hidden forms or JavaScript that automatically submits requests to a victim's ComfyUI server. When an authenticated user visits this malicious page, their browser automatically includes session credentials with the forged request, causing the ComfyUI server to process the request as if it were legitimate.

The vulnerability mechanism centers on insufficient origin validation in the middleware layer. When requests bypass the origin-only middleware protection, they can execute actions such as workflow modifications, queue manipulations, or configuration changes without proper authorization verification.

For detailed technical analysis, see the GitHub Gist Exploit Example and VulDB #358224.

Detection Methods for CVE-2026-6589

Indicators of Compromise

• Unexpected workflow executions or queued tasks that users did not initiate
• Server logs showing requests with suspicious or missing Origin or Referer headers
• Unusual cross-origin requests to the ComfyUI server from untrusted domains
• Modified ComfyUI configurations or settings without administrator action

Detection Strategies

• Monitor web server access logs for requests lacking proper Origin headers or containing mismatched origins
• Implement web application firewall (WAF) rules to detect and block potential CSRF attack patterns
• Review ComfyUI server logs for unusual request patterns, particularly state-changing operations from unexpected sources
• Deploy SentinelOne agents to detect post-exploitation activities and anomalous process behavior

Monitoring Recommendations

• Enable detailed request logging on ComfyUI servers to capture Origin, Referer, and session information
• Configure alerting for high volumes of state-changing requests within short time periods
• Monitor for browser-based attack indicators in network traffic analysis tools
• Implement user behavior analytics to detect actions inconsistent with normal usage patterns

How to Mitigate CVE-2026-6589

Immediate Actions Required

• Restrict network access to ComfyUI instances using firewall rules, limiting exposure to trusted networks only
• Implement reverse proxy configurations with additional CSRF protection mechanisms
• Require explicit user confirmation for sensitive workflow operations
• Consider disabling remote access to ComfyUI until a patch is available

Patch Information

No official patch is currently available from the vendor. The vendor was contacted early about this disclosure but did not respond. Users should monitor the VulDB submission and official ComfyUI repositories for updates regarding security fixes.

Workarounds

• Deploy a reverse proxy (such as nginx or Apache) with additional CSRF token validation in front of ComfyUI
• Restrict ComfyUI server access to localhost only (--listen 127.0.0.1) when remote access is not required
• Use browser extensions or network-level controls to prevent authenticated sessions from being exposed to untrusted websites
• Implement network segmentation to isolate ComfyUI instances from general browsing traffic

# Example: Restrict ComfyUI to localhost only
python main.py --listen 127.0.0.1 --port 8188

# Example: nginx reverse proxy with basic origin restrictions
# Add to nginx server block:
# if ($http_origin !~* "^https?://(localhost|127\.0\.0\.1)") {
#     return 403;
# }