CVE-2026-73485

Executive Summary

CVE-2026-73485 is a pre-authentication code injection vulnerability in Flowise versions prior to 3.1.3, specifically present in the Airtable Agent node. An unauthenticated attacker can send crafted prompts to a publicly exposed chatflow that uses this node, causing arbitrary Python code to be executed on the host operating system. Given that the Python runtime is described as unsandboxed and running with full host access, successful exploitation results in complete server compromise.

Technical Analysis

The vulnerability is classified under CWE-94, Improper Control of Generation of Code. The affected component is the Flowise Airtable Agent node, which is a workflow node intended to allow conversational AI agents to interact with Airtable data. According to the NVD description, the node evaluates or generates Python code to satisfy user prompts. This code is supposed to be filtered by a pythonCodeValidator blocklist, which apparently rejects dangerous Python constructs before execution.

The weakness exists because an attacker can bypass this blocklist using obfuscation techniques. The NVD description does not specify the exact obfuscation method, but the vulnerability class implies that the validator is a static or pattern-based blocklist rather than an AST-based or policy-enforcing sandbox. Obfuscated Python can therefore be structured to avoid the blocklist’s string or token signatures while still being syntactically valid and executable when passed to the Python interpreter.

The execution environment is described as an unsandboxed pyodide runtime. Pyodide is normally a WebAssembly-based Python environment that runs in a browser context and is constrained by browser security boundaries. The NVD description states the particular deployment is unsandboxed and has full access to the host operating system, meaning that the Python code can interact with the file system, network, environment variables, and other OS-level resources. In practical terms, this is equivalent to server-side code execution as the account running the Flowise process.

The attack surface is any internet-facing Flowise instance with a chatflow that includes the Airtable Agent node. Because the attacker interacts through the chatflow interface with crafted natural-language prompts, no prior authentication is required if the chatflow is publicly exposed. The Airtable Agent node bridges the user-controlled prompt and Python code execution, making the vulnerability exploitable through normal chatflow messaging.

Insufficient technical detail is available regarding the internal function names, API endpoints, or specific validation bypass primitives. However, the vulnerability mechanism is clear: user-supplied prompts lead to generation or selection of Python code that is insufficiently validated and then executed with host-level privileges.

Exploitation Scenarios

Reconnaissance and target identification:
An attacker scans the internet for publicly accessible Flowise instances. Internet-facing chatflows are the primary target because they accept untrusted prompts. The presence of an exposed Flowise interface can often be determined from the application’s title, HTML content, or TLS certificate subject.

Trigger of the vulnerable condition:
The attacker interacts with a chatflow that is configured with the Airtable Agent node. Instead of a benign request, the attacker submits a crafted prompt containing obfuscated Python expressions. Because the pythonCodeValidator blocklist is bypassable through obfuscation, the prompt succeeds in steering the agent toward malicious Python code execution.

Payload and execution method:
The malicious Python code is submitted indirectly through the prompt. The Airtable Agent node then executes the resulting Python code in the unsandboxed pyodide environment. The execution is at the vulnerability-class level a code injection: the attacker-supplied content is interpreted as code rather than data. Expected primitives would include Python os.system, eval, exec, or similar functionality, although the exact primitives are not disclosed in the NVD description.

Post-exploitation impact:
Because the Python environment has full access to the host operating system, an attacker who achieves arbitrary Python code execution can read sensitive files, access environment variables and secrets, exfiltrate data, create new processes, and potentially move laterally to other systems. The confidentiality, integrity, and availability of the underlying host and all applications running on it are at risk.

No public PoC is currently available; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

No CVSS vector has been published for CVE-2026-73485, so a numeric severity score is not available. Qualitatively, the impact is critical: the vulnerability is exploitable by unauthenticated attackers, requires no user interaction, and results in arbitrary code execution with full host OS access. The affected component is a widely reusable node in Flowise workflows, meaning many custom applications may inherit the vulnerability simply by enabling the Airtable Agent node.

The blast radius is not limited to the Flowise process. If the Flowise service runs with elevated privileges or under a shared service account, the attacker inherits those privileges. Even under a low-privileged account, host-level access to a server often enables credential harvesting, lateral movement, and data compromise. The NVD description’s explicit statement that the environment is unsandboxed with full host access elevates this beyond a typical application-level flaw.

EPSS places the current exploitation likelihood at 0.00283, with a 20.8% percentile in the EPSS model. CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog. These facts suggest there is no confirmed in-the-wild exploitation evidence at the time of reporting, but the ease of exploitation via chatflow prompts should encourage immediate patching rather than deferring remediation based on EPSS alone.

Detection Guidance

The following detection content is intended to identify likely exploitation attempts. The rules are based on the vulnerability class and the publicly disclosed components: Flowise, the Airtable Agent node, the pythonCodeValidator, and the pyodide runtime. Because no public PoC exists, these rules should be treated as starting points and tuned to the local environment.

Sigma Rule

title: Suspicious Python Process Spawned by Flowise Node Process
id: 5cbe19c1-738c-4b1d-8fc4-6b7a8c09a2d1
status: experimental
description: Detects a Python interpreter launched by a Node.js process running Flowise, potentially indicating CVE-2026-73485 exploitation.
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\node'
    ParentCommandLine|contains:
      - 'flowise'
  selection_python:
    Image|endswith:
      - '\python.exe'
      - '\python'
      - '\python3.exe'
      - '\python3'
    CommandLine|contains:
      - '-c'
      - 'eval'
      - 'exec'
      - 'os.system'
      - 'subprocess'
  condition: selection_parent and selection_python
level: high
falsepositives:
  - Legitimate Flowise automation invoking Python for data processing
tags:
  - attack.t1190
  - cve.2026.73485
  - cwe.94

YARA Rule

rule Flowise_Airtable_Agent_Code_Injection
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects likely CVE-2026-73485 payloads in HTTP request bodies, logs, or packet captures."
        cve = "CVE-2026-73485"
        reference = "NVD Description"
        date = "2026-05-20"
    strings:
        $s1 = "Airtable" ascii wide nocase
        $s2 = "pythonCodeValidator" ascii wide nocase
        $s3 = "pyodide" ascii wide nocase
        $s4 = "eval(" ascii wide
        $s5 = "exec(" ascii wide
        $s6 = "os.system" ascii wide
        $s7 = "subprocess" ascii wide nocase
        $s8 = "__import__" ascii wide nocase
    condition:
        $s1 and $s2 and 1 of ($s4, $s5, $s6, $s7, $s8)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73485 Flowise Airtable Agent Code Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Airtable"; nocase; http.request_body; content:"python"; nocase; http.request_body; content:"eval"; nocase; classtype:attempted-admin; sid:2026073485; rev:1;)

Elastic Detection

process where event.action in ("exec-command", "process-created") and
  process.name in ("python", "python3", "python.exe") and
  process.parent.name in ("node", "node.exe") and
  process.parent.command_line like "*flowise*" and
  (process.command_line like "*eval*" or
   process.command_line like "*exec*" or
   process.command_line like "*os.system*" or
   process.command_line like "*subprocess*")

Splunk SPL Query

index=windows OR index=linux sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=linux_audit
| where (ParentImage="*flowise*" OR ParentCommandLine="*flowise*") AND (Image="*python*") AND (CommandLine="*eval*" OR CommandLine="*exec*" OR CommandLine="*os.system*" OR CommandLine="*subprocess*")
| stats count min(_time) max(_time) by host, SourceIP, User, ParentImage, Image, CommandLine
| sort - count

Wazuh OSSEC Rule

<group name="flowise,">
  <rule id="100345" level="12">
    <decoded_as>sysmon</decoded_as>
    <field name="win.system.eventID">^1$</field>
    <field name="win.eventdata.Image">python</field>
    <field name="win.eventdata.ParentCommandLine">flowise</field>
    <description>CVE-2026-73485 possible exploitation - Flowise process spawned Python</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for CVE-2026-73485 is rated 2/4: a patch is claimed by a single source, OSV, but is not independently confirmed. The NVD description indicates the affected version is prior to 3.1.3, implying the fix is introduced in Flowise 3.1.3.

Immediate mitigations:

• If a chatflow uses the Airtable Agent node, disable or remove that node until the patch can be applied.
• Restrict network access to Flowise chatflow endpoints to trusted users or internal networks only. This reduces the unauthenticated attack surface even though it does not fix the underlying flaw.
• Do not expose Flowise to the public internet unless absolutely necessary. Put it behind an authenticated reverse proxy or VPN.
• Monitor for unexpected Python processes spawned by the Flowise process.

Patch and upgrade steps:

• Update to Flowise 3.1.3 or later as soon as that version is verified in an isolated test environment.
• Confirm the patch with the vendor or project maintainer because the patch claim is not independently corroborated.
• After upgrading, verify that the pythonCodeValidator blocks known obfuscation bypass attempts against the Airtable Agent node.

Long-term hardening:

• Replace blocklist-based code validation with allowlist-based validation, sandboxing, or policy enforcement that does not rely on pattern matching.
• Run Flowise under a dedicated least-privilege service account with restricted file system, network, and OS access.
• If possible, execute Python code in a true sandbox or container with no host access.
• Audit and review all Flowise workflows, especially those that accept untrusted user input.
• Subscribe to Flowise security advisories and the OSV database for updates relevant to this CVE.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73485
• OSV Vulnerability Entry: https://osv.dev/vulnerability/CVE-2026-73485
• CWE-94: Improper Control of Generation of Code: https://cwe.mitre.org/data/definitions/94.html
• MITRE ATT&CK Technique T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS: https://www.first.org/epss/

There are currently no known active threat actor campaigns targeting this CVE, no public exploit code, no Nuclei template, and no CISA KEV listing. The absence of confirmed in-the-wild exploitation should not delay remediation given the critical, unauthenticated remote code execution impact.