CVE-2026-67428 Details
Description
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/third_party/developer/http/requests.py, core.api.http_get, core.api.http_post, graphql.query, graphql.mutation, monitor.http_check, communication.slack_send, notification.discord.send_message, notification.slack.send_message, notification.teams.send_message, ai.vision_analyze, verify.visual_diff, browser.proxy_rotate, and the agent and llm inline base_url branch fetch caller-controlled URLs without validate_url_with_env_config, allowing SSRF to internal or metadata endpoints. This issue is fixed in version 2.26.7.
A server-side request forgery (SSRF) vulnerability has been identified in Flyto2 Core versions prior to 2.26.7. This issue arises in several HTTP-emitting modules that fetch client-controlled URLs without proper validation, allowing access to internal or metadata endpoints. The vulnerability could be exploited to read cloud metadata responses, including sensitive IAM credentials, or interact with internal services.
Users are advised to upgrade to Flyto2 Core version 2.26.7, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/flytohub/flyto-core/security/advisories/GHSA-pgwh-4jj4-qm8v | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9 | [email protected] | Source CodeVendor |
| https://github.com/flytohub/flyto-core/releases/tag/v2.26.7 | [email protected] | Release NotesVendor |
| https://github.com/flytohub/flyto-core/security/advisories/GHSA-pgwh-4jj4-qm8v | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flyto2 Core | <= 2.26.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |