CVE-2026-67426

Deferred Deferred - Pending Action

Unauthenticated SSRF in Flyto2 Core via Verification Service

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url for an outbound POST with X-Internal-Key: $FLYTO_RUNNER_SECRET while bypassing target_allowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67426

Affected Vendors & Products

Vendor	Product	Version / Range
flyto	flyto2_core	to 2.26.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

The vulnerability is in Flyto2 Core before version 2.26.7. It involves an unauthenticated POST endpoint at /run on port 8344 that allows attackers to make outbound requests to arbitrary URLs using a client-supplied callback_url. The service sends sensitive data with an internal key header, enabling unauthenticated Server-Side Request Forgery (SSRF) and potential exfiltration of the runner secret.

Detection Guidance

Check if the flyto-verification service is running on port 8344 without authentication. Use commands like 'netstat -tulnp | grep 8344' or 'ss -tulnp | grep 8344' to verify service exposure. Inspect network traffic for unexpected outbound POST requests to callback_url endpoints.

Impact Analysis

This vulnerability allows attackers to perform SSRF attacks, which could lead to internal network reconnaissance, unauthorized access to internal services, or exfiltration of sensitive data like the FLYTO_RUNNER_SECRET. It may also enable further attacks on connected systems if the internal key is compromised.

Compliance Impact

This vulnerability allows unauthenticated Server-Side Request Forgery (SSRF) and exfiltration of sensitive runner secrets, which could lead to unauthorized data access or manipulation. Such exposure risks violating GDPR's data protection principles and HIPAA's safeguards for protected health information by enabling unauthorized system interactions or data breaches.

Mitigation Strategies

Upgrade Flyto2 Core to version 2.26.7 or later. If immediate upgrade is not possible, restrict access to port 8344 via firewall rules or disable the flyto-verification service until patched.

Hi! I’m here to help you understand CVE-2026-67426. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70