PT-2026-65893 · Flytohub · Flyto-Core

CVE-2026-67426 · Publicado 2026-07-29 · Atualizado 2026-07-29

Mitre

CVSS v3.1

9.3

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback url for an outbound POST with X-Internal-Key: $FLYTO RUNNER SECRET while bypassing target allowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7.

Exploit

Correção

Insufficiently Protected Credentials

Missing Authentication

SSRF

Enumeração de Fraquezas

CWE-522

CWE-306

CWE-918

Identificadores relacionados

CVE-2026-67426

Produtos afetados

Flyto-Core

Referências · 4

• 🔥 https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67 · Exploit
• https://github.com/flytohub/flyto-core/releases/tag/v2.26.7 · Nota
• https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-67426 · Nota de Segurança