CVE-2026-67427

Received Received - Intake

Flyto2 Core Workflow Engine Variable Resolver Security Bypass

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue is fixed in version 2.26.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-67427

Affected Vendors & Products

Vendor	Product	Version / Range
flyto2	core	to 2.26.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

Executive Summary

Flyto2 Core before 2.26.6 has a flaw where the workflow engine variable resolver expands ${env.VAR} for any host environment variable without restrictions. This allows workflow parameters to bypass capability policy denylists for env.get and env.load_dotenv, potentially exposing secrets through allowed modules.

Detection Guidance

Check Flyto2 Core version with 'flyto2 --version' or inspect workflow files for ${env.VAR} patterns. Monitor for unexpected secret exfiltration attempts via allowed modules.

Impact Analysis

An attacker could craft a workflow parameter to access sensitive environment variables, leading to secret exfiltration. This bypasses default security policies, risking data breaches or unauthorized access to confidential information.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing personal or health data through unauthorized environment variable access. Compliance requires preventing unauthorized data exposure, which this flaw enables.

Mitigation Strategies

Upgrade Flyto2 Core to version 2.26.6 or later. Review workflow parameters to remove ${env.VAR} usage. Implement allowlist policies for environment variable access.

Hi! I’m here to help you understand CVE-2026-67427. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70