flytohub

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

flytohub records in CISA KEV

No flytohub vulnerabilities are listed in CISA KEV.

Records

9 records

TI-2026-47709 CVE-2026-67429 · GHSA-2956-977x-2w3r

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

HIGH 82

Flyto2 Core is an execution kernel for automation and AI-agent workflows.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00575 Published 2026-07-29 Fixed in 2.26.6, 2.26.7 CWE-22

TI-2026-47706 CVE-2026-67426 · GHSA-jx74-cqjv-2c67

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

HIGH 79

Flyto2 Core is an execution kernel for automation and AI-agent workflows.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00374 Published 2026-07-29 Fixed in 2.26.7 CWE-306

TI-2026-47707 CVE-2026-67427 · GHSA-hr7p-wg7r-hg9m

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

HIGH 76

Flyto2 Core is an execution kernel for automation and AI-agent workflows.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00446 Published 2026-07-29 Fixed in 2.26.6, 2.26.7 CWE-522

TI-2026-47705 CVE-2026-67425 · GHSA-qq9q-xgm3-xv9g

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

HIGH 76

Flyto2 Core is an execution kernel for automation and AI-agent workflows.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00406 Published 2026-07-29 Fixed in 2.26.6, 2.26.7 CWE-201

TI-2026-74172 CVE-2026-55786 · GHSA-h9f9-h6gm-wc85

Unauthenticated command execution in Flyto2 Core over HTTP MCP

HIGH 72

Flyto2 Core is an execution kernel for automation and AI-agent workflows.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.0041 Published 2026-10-14 Fixed in 2.26.4 CWE-306

TI-2026-47708 CVE-2026-67428 · GHSA-pgwh-4jj4-qm8v

Server-side request forgery in flytohub flyto-core

HIGH 70

Flyto2 Core is an execution kernel for automation and AI-agent workflows.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00409 Published 2026-07-29 Fixed in 2.26.7 CWE-918

TI-2026-47704 CVE-2026-67424 · GHSA-c9hr-64h3-gxpc

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

HIGH 70

Flyto2 Core is an execution kernel for automation and AI-agent workflows.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00293 Published 2026-07-29 Fixed in 2.26.7 CWE-918

TI-2026-74438 CVE-2026-55787

SSRF guard bypass in Flyto2 Core via IPv6 transition addresses

MEDIUM 64

Flyto2 Core is an execution kernel for automation and AI-agent workflows.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00292 Published 2026-10-14 Fixed in 2.26.3 CWE-918

TI-2026-51630 CVE-2026-73530 · GHSA-35jm-rm2f-hpgj

Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()

MEDIUM 61

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes…

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00426 Published 2026-08-13 Fixed in 2.28.0 CWE-918

Open these records in search →