PT-2026-65894 · Flytohub · Flyto-Core

CVE-2026-67427 · Published 2026-07-29 · Updated 2026-07-29

NVD

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load dotenv and exfiltrate secrets through allowed modules. This issue is fixed in version 2.26.6.

Fix

Exposure of Resource to Wrong Sphere

Insufficiently Protected Credentials

Protection Mechanism Failure

Weakness Enumeration

CWE-668

CWE-522

CWE-693

Related Identifiers

CVE-2026-67427

Affected Products

Flyto-Core

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-67427 · Security Note
• https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc · Note
• https://github.com/flytohub/flyto-core/security/advisories/GHSA-hr7p-wg7r-hg9m · Note
• https://github.com/flytohub/flyto-core/releases/tag/v2.26.6 · Note