CVE-2026-81662 Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/configmodule.py. The vulnerabl...

CVE-2026-81662

Flowintel (versions ≥3.3.0 ) is vulnerable to Remote Code Execution via its alerts settings update endpoint. The root cause is improper handling of requester-supplied configuration keys: while values were normalized to Python literals, the keys themselves were injected directly into the source of...