CVE-2026-25632: EPyT-Flow REST API RCE Vulnerability

CVE-2026-25632 Overview

CVE-2026-25632 is a critical insecure deserialization vulnerability in EPyT-Flow, a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to version 0.16.1, EPyT-Flow's REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments.

This design flaw allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This vulnerability also affects the loading of JSON files through the same deserialization mechanism.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary command execution on systems running vulnerable EPyT-Flow instances by sending maliciously crafted JSON payloads to the REST API or by manipulating JSON files processed by the application.

Affected Products

• EPyT-Flow versions prior to 0.16.1
• Systems exposing EPyT-Flow REST API endpoints
• Applications processing untrusted JSON files through EPyT-Flow's deserialization functions

Discovery Timeline

• February 6, 2026 - CVE-2026-25632 published to NVD
• February 6, 2026 - Last updated in NVD database

Technical Details for CVE-2026-25632

Vulnerability Analysis

This vulnerability falls under CWE-502 (Deserialization of Untrusted Data), representing one of the most dangerous vulnerability classes in web applications. The custom JSON deserializer in EPyT-Flow implements a dynamic class instantiation feature that was designed for flexibility but inadvertently created a severe security gap.

The my_load_from_json function processes JSON input and checks for the presence of a type field. When found, it uses Python's importlib module to dynamically import the specified module and class, then instantiates the object with provided arguments. This pattern is inherently dangerous because it allows attackers to specify any Python class available in the runtime environment, including system classes designed for process execution.

The attack surface includes both the REST API endpoints that accept JSON input and any functionality that loads JSON files from disk or external sources, significantly expanding potential exploitation scenarios in water distribution network management systems.

Root Cause

The root cause is the use of dynamic module importing and class instantiation based on user-controlled input in the my_load_from_json deserialization function. The lack of allowlisting or sanitization of the type field permits attackers to specify arbitrary Python classes, including dangerous ones like subprocess.Popen that can execute system commands.

Attack Vector

An attacker can exploit this vulnerability by sending a specially crafted JSON payload to the EPyT-Flow REST API. The payload includes a type field specifying a dangerous class (e.g., subprocess.Popen) along with the necessary arguments to execute arbitrary commands. The deserialization process automatically imports the specified module and instantiates the class, leading to immediate command execution.

The attack requires network access to the REST API endpoint and does not require any authentication, making it exploitable by unauthenticated remote attackers.

 from abc import abstractmethod, ABC
 from io import BufferedIOBase
 import pathlib
-import importlib
 import json
 import gzip
 import umsgpack

Source: GitHub Commit Details

The security patch removes the importlib import entirely, indicating that the dynamic module loading functionality was eliminated from the deserialization logic as the fix for this vulnerability.

Detection Methods for CVE-2026-25632

Indicators of Compromise

• Unusual JSON payloads containing type fields with module paths like subprocess.Popen, os.system, or other dangerous class references in API logs
• Unexpected child processes spawned by the EPyT-Flow application or its parent Python process
• Network connections or file system modifications originating from the EPyT-Flow service that are inconsistent with normal water network simulation operations
• Log entries showing JSON parsing errors with unusual module/class names

Detection Strategies

• Implement application-layer firewall rules to inspect JSON payloads for suspicious type field values containing dangerous module names
• Deploy runtime application self-protection (RASP) solutions to detect and block dynamic class instantiation attempts with dangerous classes
• Monitor for command injection patterns in web application firewall (WAF) logs targeting EPyT-Flow endpoints
• Use behavioral analysis to detect process execution anomalies from Python-based services

Monitoring Recommendations

• Enable verbose logging on EPyT-Flow REST API endpoints to capture full request bodies for forensic analysis
• Set up alerts for process creation events originating from the EPyT-Flow application service account
• Monitor network egress from systems running EPyT-Flow for unexpected outbound connections that may indicate post-exploitation activity
• Implement file integrity monitoring on systems processing JSON files through EPyT-Flow

How to Mitigate CVE-2026-25632

Immediate Actions Required

• Upgrade EPyT-Flow to version 0.16.1 or later immediately, as this version contains the security fix
• If immediate upgrade is not possible, restrict network access to EPyT-Flow REST API endpoints using firewall rules
• Audit all JSON files processed by EPyT-Flow deployments for suspicious type field entries
• Review application logs for evidence of prior exploitation attempts

Patch Information

The vulnerability has been fixed in EPyT-Flow version 0.16.1. The patch removes the dynamic import functionality from the JSON deserialization process, eliminating the ability for attackers to specify arbitrary classes for instantiation. The security fix is documented in the GitHub Security Advisory GHSA-74vm-8frp-7w68 and the corresponding release notes for version 0.16.1.

Workarounds

• Deploy a reverse proxy or WAF in front of EPyT-Flow REST API endpoints to filter JSON payloads containing suspicious type fields
• Implement network segmentation to limit access to EPyT-Flow services to trusted internal networks only
• Disable REST API functionality if not required for operations until the upgrade can be completed
• Validate all JSON files from external sources before processing through EPyT-Flow

# Example: Upgrade EPyT-Flow to patched version
pip install --upgrade epyt-flow>=0.16.1

# Verify installed version
pip show epyt-flow | grep Version