What’s Vulnerable › Vulnerabilities

CVE-2026-67426: Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

• Severity: critical (CVSS 9.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-29 · updated 2026-10-24
• Weakness: CWE-306

Description

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url for an outbound POST with X-Internal-Key: $FLYTO_RUNNER_SECRET while bypassing target_allowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7.

Affected products

• flytohub flyto-core: before 2.26.7

References

• https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9
• https://github.com/flytohub/flyto-core/releases/tag/v2.26.7
• https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67
• https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67

Get alerted when CVE-2026-67426 or the next vulnerability affects your stack