CVE-2026-67426 Details
Description
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url for an outbound POST with X-Internal-Key: $FLYTO_RUNNER_SECRET while bypassing target_allowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7.
A critical unauthenticated Server-Side Request Forgery (SSRF) vulnerability has been identified in Flyto2 Core versions prior to 2.26.7. The issue resides in the standalone flyto-verification service, specifically within the verification_service.py file. The vulnerability allows attackers to exploit the POST /run endpoint, which is exposed on all network interfaces (0.0.0.0) at port 8344. The endpoint lacks authentication and accepts a callback_url parameter that is used to make an outbound POST request. This request includes the X-Internal-Key header with the value of the FLYTO_RUNNER_SECRET, bypassing any target restrictions and exposing the secret to an attacker-controlled destination. The flaw enables unauthorized access to internal metadata endpoints and the exfiltration of sensitive runner secrets.
Users are advised to upgrade to Flyto2 Core version 2.26.7 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9 | [email protected] | Source CodeVendor |
| https://github.com/flytohub/flyto-core/releases/tag/v2.26.7 | [email protected] | Release NotesVendor |
| https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flyto2 Core | <= 2.26.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |