CVE-2026-81662 Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys
Attackers can execute arbitrary Python code by injecting malicious configuration keys into the alert settings update endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81662?
CVE-2026-81662 is a high-severity code injection vulnerability in flowintel, published on 27 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/config_module.py.
The vulnerable code used requester-controlled keys in both the regular expression and the generated assignment:
f'{key} = {py_val}'
and appended an assignment if the key was not already present. The modified Python configuration module was subsequently reloaded using importlib.reload(). This creates a code-generation boundary in which specially crafted configuration keys can alter the Python source structure and result in execution of attacker-controlled Python statements.
Version impacted >=3.3.0
Which versions are affected by CVE-2026-81662?
How do I fix CVE-2026-81662?
No fix has been published for CVE-2026-81662 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-81662 being exploited?
There is no known exploitation of CVE-2026-81662 in the wild and no public exploit code.
Sources
Also known as GHSA-pvfv-9f26-pxv8.