CVE-2026-67425
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Vulnerability in Flyto2 Core before version 2.26.6 allows the llm.chat module to read provider keys (e.g., OPENAI_API_KEY) from the environment and send them in the Authorization header to an attacker-controlled server, leading to key leakage.
Risk Assessment
An attacker can capture the operator's API keys, enabling unauthorized use of AI services at the organization's expense.
Recommendation
Update Flyto2 Core to version 2.26.6 or later.
Other vulnerabilities in Flyto2 Core
See all- CVE-2026-67429Critical
A vulnerability in Flyto2 Core before version 2.26.6 allows an attacker to write files to arbitrary filesystem paths by controlling the output_dir parameter in the image.download module. The lack of path validation against the FLYTO_SANDBOX_DIR configuration enables writing response bytes anywhere.
- CVE-2026-67426Critical
A vulnerability in Flyto2 Core before version 2.26.7 in the flyto-verification service allows unauthenticated attackers to perform SSRF and steal the runner secret. The server listens on 0.0.0.0:8344 and uses a client-supplied callback_url to send a POST request with the X-Internal-Key header, bypassing target_allowed validation.
- CVE-2026-73530High
Flyto2 Core before version 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to bypass the private IP range and blocked hostname checks in is_private_ip(), reaching services bound to IPv6 loopback across the http.get, http.request, and http.batch modules.
- CVE-2026-67428High
Vulnerability in Flyto2 Core before version 2.26.7 allows an attacker to perform SSRF requests to internal or metadata endpoints via HTTP modules that fetch attacker-controlled URLs without validation.
- CVE-2026-67427High
Vulnerability in Flyto2 Core before version 2.26.6 allows environment variable expansion ${env.VAR} without an allowlist, bypassing the default denylist policy and exfiltrating secrets through allowed modules.
- CVE-2026-67424High
In Flyto2 Core prior to version 2.26.7, HTTP modules validate only the initial URL and then follow redirects without per-hop Location revalidation. This allows a public URL to redirect into internal address space and return the internal response body.
Original NVD description (English source)
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from the environment and sends them in the Authorization: Bearer header to caller-controlled base_url, allowing an attacker to receive the operator's key on a public host that passes the SSRF guard. This issue is fixed in version 2.26.6.