CVE-2026-67424 Details
Description
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial URL, then follow redirects with allow_redirects=True and without per-hop Location revalidation, allowing a public URL to redirect into internal address space and return the internal response body. This issue is fixed in version 2.26.7.
A server-side request forgery (SSRF) vulnerability has been identified in Flyto2 Core versions prior to 2.26.7. The issue arises in the HTTP modules 'http.get', 'http.request', and 'http.batch', which validate only the initial URL before following redirects into internal address space. This flaw allows a public URL to redirect to a private address, exposing internal response bodies.
Users are advised to upgrade to Flyto2 Core version 2.26.7, which includes the necessary SSRF protections. Instructions for upgrading are available in the release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/flytohub/flyto-core/security/advisories/GHSA-c9hr-64h3-gxpc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9 | [email protected] | Source CodeVendor |
| https://github.com/flytohub/flyto-core/releases/tag/v2.26.7 | [email protected] | Release NotesVendor |
| https://github.com/flytohub/flyto-core/security/advisories/GHSA-c9hr-64h3-gxpc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flyto2 Core | <= 2.26.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |