ZDI-26-546: Flowise Airtable_Agent Code Injection Remote Code Execution Vulnerability
ZDI discloses an unauthenticated code injection remote code execution flaw in Flowise's Airtable_Agent (CVE-2026-69264, CVSS 9.8).
ZDI advisory ZDI-26-546 describes a code injection vulnerability in the Flowise Airtable_Agent that allows remote attackers to execute arbitrary code. No authentication is required to exploit the flaw, which carries a CVSS rating of 9.8 and is assigned CVE-2026-69264. Flowise deployments exposing the vulnerable agent component are at risk of full server takeover.
- Code injection in Flowise Airtable_Agent enables unauthenticated RCE
- CVSS 9.8, assigned CVE-2026-69264
- Exposed Flowise instances face full compromise without credentials
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-69264 | RCE in Flowise CSVAgent via Pyodide Code Injection (pre-3.1.3) | 9.4 | 1% | PoC |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.