CVE-2026-67428

A vulnerability in Flyto2 Core before version 2.26.6 allows an attacker to write files to arbitrary filesystem paths by controlling the output_dir parameter in the image.download module. The lack of path validation against the FLYTO_SANDBOX_DIR configuration enables writing response bytes anywhere.

A vulnerability in Flyto2 Core before version 2.26.7 in the flyto-verification service allows unauthenticated attackers to perform SSRF and steal the runner secret. The server listens on 0.0.0.0:8344 and uses a client-supplied callback_url to send a POST request with the X-Internal-Key header, bypassing target_allowed validation.

Flyto2 Core before version 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to bypass the private IP range and blocked hostname checks in is_private_ip(), reaching services bound to IPv6 loopback across the http.get, http.request, and http.batch modules.

Vulnerability in Flyto2 Core before version 2.26.6 allows environment variable expansion ${env.VAR} without an allowlist, bypassing the default denylist policy and exfiltrating secrets through allowed modules.

Vulnerability in Flyto2 Core before version 2.26.6 allows the llm.chat module to read provider keys (e.g., OPENAI_API_KEY) from the environment and send them in the Authorization header to an attacker-controlled server, leading to key leakage.

In Flyto2 Core prior to version 2.26.7, HTTP modules validate only the initial URL and then follow redirects without per-hop Location revalidation. This allows a public URL to redirect into internal address space and return the internal response body.