CVE-2026-67426: Flyto2 Core SSRF Vulnerability

CVE-2026-67426 Overview

CVE-2026-67426 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in Flyto2 Core, an execution kernel for automation and AI-agent workflows. The standalone flyto-verification service in src/core/verification_service.py exposes an unauthenticated POST /run endpoint on 0.0.0.0:8344. The service uses a client-supplied callback_url for an outbound POST request while bypassing the target_allowed allowlist. The outbound request carries the X-Internal-Key: $FLYTO_RUNNER_SECRET header, enabling attackers to exfiltrate the runner secret and pivot into internal infrastructure. The issue is fixed in version 2.26.7.

Critical Impact
Unauthenticated network attackers can trigger arbitrary outbound requests from the Flyto2 Core host and capture the runner secret used to authenticate to internal services.

Affected Products

Flyto2 Core (flytohub/flyto-core) versions prior to 2.26.7
flyto-verification standalone service listening on 0.0.0.0:8344
Deployments exposing the verification service to untrusted networks

Discovery Timeline

2026-07-29 - CVE-2026-67426 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-67426

Vulnerability Analysis

The flaw resides in the standalone verification service implemented in src/core/verification_service.py. The service binds to 0.0.0.0:8344 and exposes a POST /run endpoint without any authentication requirement, mapping to [CWE-306: Missing Authentication for Critical Function]. When a request is received, the handler reads the callback_url field from the client-supplied JSON body and issues an outbound POST request to that URL. This code path bypasses the target_allowed allowlist used elsewhere in the codebase to constrain outbound destinations.

Critically, the outbound request includes the header X-Internal-Key: $FLYTO_RUNNER_SECRET. An attacker who supplies a callback_url pointing to an attacker-controlled host receives the runner secret in plaintext. That secret grants privileged access to the internal runner API. The same primitive also enables classic SSRF: reaching cloud metadata endpoints, internal admin interfaces, and non-routable backend services from the vulnerable host.

Root Cause

Two defects combine to produce the vulnerability. First, the /run endpoint lacks authentication, so any network-reachable client can invoke it. Second, the outbound request logic does not enforce the target_allowed URL allowlist that would otherwise block internal or attacker-controlled destinations. Individual automation modules also lacked per-module outbound guards.

Attack Vector

An unauthenticated attacker sends a crafted POST /run request containing a callback_url pointing to a host they control. The service issues an outbound POST to that URL with the X-Internal-Key header populated from FLYTO_RUNNER_SECRET, exposing the secret. The attacker can then replay the secret against the internal runner API or redirect callbacks to internal-only endpoints such as http://169.254.169.254/ for cloud metadata theft.

python

# Patch excerpt: src/core/modules/atomic/ai/vision_analyze.py
 from ...errors import ModuleError, ValidationError
 from ...registry import register_module
 from ...schema import compose, field
+from ....utils import enforce_outbound_url, SSRFError
 
 logger = logging.getLogger(__name__)

Source: GitHub commit 0a0a528

The patch introduces enforce_outbound_url and SSRFError into vulnerable modules such as vision_analyze.py and proxy_rotate.py, adding per-module SSRF guards in addition to fixing the verification service authentication.

Detection Methods for CVE-2026-67426

Indicators of Compromise

Inbound POST /run requests to TCP port 8344 from unexpected source IPs
Outbound HTTP requests from the Flyto2 Core host carrying the X-Internal-Key header to destinations outside the configured allowlist
Outbound requests from the host to link-local metadata endpoints (169.254.169.254) or RFC1918 addresses not previously seen
Unusual callback_url values in verification service access logs pointing to external domains

Detection Strategies

Alert on any process traffic to 0.0.0.0:8344 originating from outside the trusted management network segment
Inspect verification service logs for POST /run invocations lacking a preceding authentication event
Correlate outbound HTTP egress from Flyto2 Core hosts against the documented target_allowed allowlist and flag deviations

Monitoring Recommendations

Capture and retain full HTTP request bodies for the /run endpoint to identify malicious callback_url values
Monitor for anomalous use of the FLYTO_RUNNER_SECRET value in downstream authentication logs
Track version strings reported by the Flyto2 Core service to confirm remediation to 2.26.7 across the fleet

How to Mitigate CVE-2026-67426

Immediate Actions Required

Upgrade Flyto2 Core to version 2.26.7 or later, which contains the authoritative fix
Rotate the FLYTO_RUNNER_SECRET value on all deployments, since exposure cannot be excluded prior to patching
Restrict network access to TCP port 8344 so only trusted hosts can reach the verification service
Audit outbound proxy and firewall logs for prior exfiltration of the runner secret

Patch Information

The vendor released Flyto2 Core v2.26.7 containing the fix. See the GitHub Release v2.26.7, the GitHub Security Advisory GHSA-jx74-cqjv-2c67, and the remediation commit 0a0a528. The patch adds authentication to /run, enforces the target_allowed allowlist on outbound requests, and introduces enforce_outbound_url guards in individual modules.

Workarounds

Block or firewall TCP port 8344 from all untrusted networks until the upgrade is applied
Bind the verification service to 127.0.0.1 instead of 0.0.0.0 via reverse proxy or container network policy
Remove or unset FLYTO_RUNNER_SECRET in environments where the verification service is not required

bash

# Restrict verification service to loopback and block external access
iptables -A INPUT -p tcp --dport 8344 ! -s 127.0.0.1 -j DROP

# Verify Flyto2 Core is upgraded to the fixed release
pip show flyto-core | grep -i version   # expect 2.26.7 or later