TI-2026-47704 Aliases CVE-2026-67424 GHSA-c9hr-64h3-gxpc

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

HIGH 70CWE-918Published 2026-07-29 · Updated 2026-07-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial URL, then follow redirects with allow_redirects=True and without per-hop Location revalidation, allowing a public URL to redirect into internal address space and return the internal response body. This issue is fixed in version 2.26.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00293 22nd percentileScored 2026-11-07

Fix Fixed flyto-core (flytohub): 2.26.7flyto-core (PyPI): 2.26.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
flytohub	flyto-core	before 2.26.7	2.26.7	Patch available	CNA
—	flyto-core (PyPI)	before 2.26.7	2.26.7	Patch available	GHSA-c9hr-64h3-gxpc

flyto-core Vendorflytohub Affected before 2.26.7 Fixed in 2.26.7 Patch available CNA
flyto-core (PyPI) Vendor— Affected before 2.26.7 Fixed in 2.26.7 Patch available GHSA-c9hr-64h3-gxpc

Remediation

Fix · CNA flyto-core (flytohub) Fixed in 2.26.7
Fix · GHSA-c9hr-64h3-gxpc flyto-core (PyPI) Fixed in 2.26.7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-67424
2026-10-03 Alias added: GHSA-c9hr-64h3-gxpc

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-67424

Other 4

TI-2026-47709 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules) CVSS 3.1CRITICAL 10.0
TI-2026-47706 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration CVSS 3.1CRITICAL 9.3
TI-2026-47707 Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted CVSS 3.1HIGH 8.6
TI-2026-47705 Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url CVSS 3.1HIGH 8.6
TI-2026-74172 Unauthenticated command execution in Flyto2 Core over HTTP MCP CVSS 3.1HIGH 8.4
TI-2026-47708 Server-side request forgery in flytohub flyto-core CVSS 3.1HIGH 8.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences