CVE-2026-13493: ComfyUI-Copilot Resource Identifier Manipulation Vulnerability

Technical summary

CVE-2026-13493 is an improper control of resource identifiers vulnerability (CWE-99) in the Workflow Checkpoint Restore Handler component of ComfyUI-Copilot. The vulnerability exists in backend/controller/conversation_api.py and allows authenticated attackers to manipulate resource identifiers during workflow checkpoint restoration. The attack requires high complexity and authenticated access, limiting exposure to users already inside the application environment. A public exploit has been released, though practical weaponization remains constrained by the high attack complexity and authentication requirement.

Business impact

For organizations using ComfyUI-Copilot, the primary risk is unauthorized modification of workflow checkpoints by authenticated users with malicious intent. This could lead to poisoning of saved states, unauthorized access to sensitive configuration data within checkpoints, or disruption of AI workflow continuity. The impact is contained by the requirement for valid authentication and high attack complexity, making opportunistic exploitation unlikely. Teams relying on ComfyUI-Copilot for production AI workflows should assess whether any users have been granted overly permissive access.

Affected systems

AIDC-AI ComfyUI-Copilot versions 2.0.28 and earlier are affected. The vulnerability requires an authenticated session, so only users with valid credentials to the application are at risk as potential vectors, and the resource manipulation can only impact checkpoints they interact with. Verify your installed version against vendor advisories to confirm exposure status.

Exploitability

Exploitation requires valid authentication credentials and cannot be performed anonymously. The attack complexity is rated as high, meaning an attacker must meet specific, non-trivial conditions within the application environment to succeed. A public exploit exists but its practical effectiveness is limited by these constraints. No active exploitation in the wild has been reported or included in the CISA Known Exploited Vulnerabilities catalog, suggesting real-world attack incidents remain uncommon.

Remediation

Update ComfyUI-Copilot to a version that includes the patch for this vulnerability. The vendor has submitted a pull request to fix the issue; monitor the official repository for the next stable release that includes this merge. Until patching is possible, restrict authenticated access to ComfyUI-Copilot to trusted users only, and implement network-level access controls limiting who can reach the application.

Patch guidance

Check the AIDC-AI ComfyUI-Copilot GitHub repository and official release notes for a patched version that addresses CVE-2026-13493. The vendor's pull request is awaiting acceptance, so a formal release may still be in preparation. Verify the exact version number in the patch advisory before deploying. In the interim, consider deploying the application only in restricted network environments or behind authentication proxies that enforce additional user vetting.

Detection guidance

Monitor application logs for unusual patterns in the conversation_api.py backend endpoint, particularly requests that attempt to restore or manipulate workflow checkpoints from unexpected sources or with suspicious parameters. Look for authenticated users accessing checkpoints they do not normally interact with, or repeated attempts to restore invalid checkpoint identifiers. Network-based detection is difficult given the authentication requirement; focus monitoring on the application layer and audit logs of checkpoint operations.

Why prioritize this

This vulnerability scores 3.1 (LOW) and carries minimal immediate risk due to its authentication requirement, high attack complexity, and confidentiality-only impact. It should be patched on a standard maintenance cycle rather than treated as emergency remediation. Prioritize this lower than unauthenticated or high-complexity vulnerabilities affecting your environment. However, do not defer indefinitely; schedule patching within your normal quarterly or bi-annual update window depending on your update cadence.

Risk score, explained

The CVSS 3.1 score of 3.1 reflects multiple limiting factors: the vulnerability requires authenticated access (PR:L), high attack complexity (AC:H), and has only a confidentiality impact with no integrity or availability consequences (C:L/I:N/A:N). The attack vector is network-accessible, but the combination of authentication and complexity requirements significantly reduces practical exploit likelihood and blast radius. This profile is typical for issues affecting developer tools or internal APIs where user base is inherently limited.

Frequently asked questions