Flowise Pre-Auth RCE, CVSS 9.8: Update Immediately to 3.1.3

ZDI-26-546 discloses a critical flaw in the low-code Flowise platform. The Airtable_Agent component executes Python code without validating user input, enabling unauthenticated remote code execution.

ZDI-26-546 went public on August 11, 2026. The Trend Micro Zero Day Initiative advisory describes an arbitrary remote code execution vulnerability in the low-code Flowise platform, popular with developers and enterprises for building AI and LLM workflows. The CVSS score is 9.8: critical. No authentication is required for exploitation. The exposure window between vendor notification and public disclosure exceeds 110 days.

Key Takeaways

ZDI-26-546 (CVE-2026-69264) affects the run method of the Airtable_Agent class in Flowise with pre-authentication RCE.
The root cause is the lack of validation of an attacker-controlled string before dynamic Python code execution.
The exploit mechanism leverages Pyodide with a js bridge to globalThis, exposing eval and child_process for sandbox breakout.
Flowise has released a corrective update; the CVE Record cites version 3.1.3 as the fix, but a potential mismatch remains with the specific Airtable_Agent component.

The Hidden Engine: From Drag-and-Drop Interface to Arbitrary Code Execution

Flowise lets users assemble AI workflows by dragging visual blocks. Under the hood, however, runs a dynamic execution engine. The Airtable_Agent component — one of the pre-built nodes for integrating Airtable databases into flows — processes queries by generating and executing Python code at runtime.

According to the ZDI advisory, the specific flaw resides in the run method of this class. The user-supplied string is interpolated directly into the Python code without prior validation. A remote attacker can inject arbitrary payloads that the engine will execute in the service account context.

This pattern — dynamic code execution with unsanitized external input — is classic, but its placement inside a low-code platform amplifies the risk. The end user dragging an Airtable node onto the canvas has no visibility into the execution subsystem. The system administrator often does not expect a database integration agent to execute Python code with process-level privileges.

Sandbox Breakout: Pyodide, JS Bridge, and Dangerous Primitives

The CVE-2026-69264 record, published on cve.org, adds a layer of detail on the exploit mechanism. Pyodide — the Python interpreter compiled to WebAssembly used by Flowise — is loaded with the default js bridge to globalThis. In a Node.js environment, this bridge exposes dangerous JavaScript primitives: eval, dynamic import, and access to built-in modules like child_process and fs.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is not required to exploit this vulnerability." — ZDI Advisory ZDI-26-546

The attacker breaks the Python string literal, passes a JavaScript string to js.eval, dynamically imports Node modules, and achieves operating-system-level execution. The Python sandbox becomes a mere formal obstacle.

A limitation in the dossier is worth noting: the CVE record describes a vulnerability in CSVAgent (not Airtable_Agent) in its text, despite being associated with the same CVE-2026-69264 identifier. This mismatch, observed in the primary cve.org source, prevents confirming with certainty that the corrected version 3.1.3 cited in the record refers to the same Airtable_Agent component covered by the ZDI advisory. The convergence on the Pyodide/js bridge mechanism is clear; the version-to-component correspondence less so.

Timeline and Exposure Window: Over 110 Days Between Report and Patch

The vulnerability was reported to Flowise on April 22, 2026. Coordinated public disclosure occurred on August 11, 2026: an interval of approximately 112 days. During this period, unpatched installations remained exposed to an attack requiring no credentials, tokens, or human interaction.

Flowise has issued a corrective update, as confirmed textually by the advisory: "Flowise has issued an update to correct this vulnerability." The dossier does not specify which prior versions were vulnerable, nor how many installations are exposed on the internet. The platform is typically distributed via Docker or Node.js, often on standard ports accessible for prediction and API services.

Immediate Actions

Priority actions derive directly from the verified facts in the dossier:

Verify the presence of running Flowise instances, with particular attention to Airtable_Agent nodes enabled in workflows.
Consult the ZDI-26-546 advisory and the CVE-2026-69264 record to compare the installed version against 3.1.3, indicated as corrective in the official database.
Inspect Flowise process execution logs for anomalous requests to the agent's run method with suspicious payloads in input strings.
Evaluate temporarily removing the Airtable_Agent node from production flows until the update is verified, given that exploitation requires no authentication.

The dossier does not document active in-the-wild exploits or public proof-of-concept code beyond the advisory. This does not diminish the severity: the low attack barrier (no authentication, simple payload via string) makes the vulnerability reproducible by actors with minimal skills once the component logic is analyzed.

Why This RCE Changes the Verdict on Low-Code AI

The problem is not strictly technical: it is architectural. Low-code platforms promise abstraction but often implement that abstraction with full dynamic execution engines — Python, JavaScript, WASM — that inherit the attack surface of a traditional runtime without inheriting its mitigations. The end user writes no code, yet code is generated and executed all the same.

Flowise is not an isolated exception. The AI/LLM ecosystem is filling with similar tools: Langflow, Dify, other visual orchestrators. Each hides an execution engine with often excessive privileges under the canvas, exposed to the internet for integration convenience. ZDI-26-546 demonstrates that the entry point can be a third-party node — Airtable_Agent — not the product core, and that the sandbox (Pyodide) can be bypassed with documented primitives.

The lesson here is that risk assessment of these platforms cannot stop at the user interface. Every dynamic execution path, every cross-language bridge, every exposure of globalThis or equivalent must be mapped. Low-code AI demands security audits with the same depth as hand-written code — perhaps more, because the obscurity is intentional.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references