Improper Trust in Configuration Keys in Flowintel by Flowintel

CVE-2026-81662

What is CVE-2026-81662?

Flowintel versions starting from 3.3.0 have a vulnerability due to improper validation of configuration keys supplied to the alerts settings update endpoint. This issue arises because while configuration values are normalized to Python literals, the associated keys are directly utilized without adequate sanitation. As a result, specially crafted keys can manipulate the Python source structure, leading to the potential execution of attacker-controlled Python statements. The vulnerability originates from code that employs requester-controlled keys in both the regular expressions and the generated assignments, creating a significant security risk for users.

References