Vulnerability Description
Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/config_module.py. The vulnerable code used requester-controlled keys in both the regular expression and the generated assignment: f'{key} = {py_val}' and appended an assignment if the key was not already present. The modified Python configuration module was subsequently reloaded using importlib.reload(). This creates a code-generation boundary in which specially crafted configuration keys can alter the Python source structure and result in execution of attacker-controlled Python statements. Version impacted >=3.3.0
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-81662?
CVE-2026-81662 is a documented vulnerability. Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding key...
How severe is CVE-2026-81662?
CVSS scoring is not yet available for CVE-2026-81662. Check NVD for updates.
Is there a patch for CVE-2026-81662?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.