PT-2026-65894 · Flytohub · Flyto-Core

CVE-2026-67427 · Publicado 2026-07-29 · Atualizado 2026-07-29

NVD

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load dotenv and exfiltrate secrets through allowed modules. This issue is fixed in version 2.26.6.

Correção

Exposure of Resource to Wrong Sphere

Insufficiently Protected Credentials

Protection Mechanism Failure

Enumeração de Fraquezas

CWE-668

CWE-522

CWE-693

Identificadores relacionados

CVE-2026-67427

Produtos afetados

Flyto-Core

Referências · 4

• https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc · Nota
• https://github.com/flytohub/flyto-core/security/advisories/GHSA-hr7p-wg7r-hg9m · Nota
• https://github.com/flytohub/flyto-core/releases/tag/v2.26.6 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-67427 · Nota de Segurança