CVE-2026-67426
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in Flyto2 Core before version 2.26.7 in the flyto-verification service allows unauthenticated attackers to perform SSRF and steal the runner secret. The server listens on 0.0.0.0:8344 and uses a client-supplied callback_url to send a POST request with the X-Internal-Key header, bypassing target_allowed validation.
Risk Assessment
An attacker can exfiltrate the runner secret and use it for further attacks on internal systems, potentially leading to full compromise of the automation environment.
Recommendation
Upgrade Flyto2 Core to version 2.26.7 or later.
Original NVD description (English source)
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url for an outbound POST with X-Internal-Key: $FLYTO_RUNNER_SECRET while bypassing target_allowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7.