PT-2026-65893 · Flytohub · Flyto-Core

CVE-2026-67426 · Published 2026-07-29 · Updated 2026-07-29

Mitre

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback url for an outbound POST with X-Internal-Key: $FLYTO RUNNER SECRET while bypassing target allowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7.

Exploit

Fix

Insufficiently Protected Credentials

Missing Authentication

SSRF

Weakness Enumeration

CWE-522

CWE-306

CWE-918

Related Identifiers

CVE-2026-67426

Affected Products

Flyto-Core

References · 4

• 🔥 https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-67426 · Security Note
• https://github.com/flytohub/flyto-core/releases/tag/v2.26.7 · Note
• https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9 · Note