TI-2026-47707 Aliases CVE-2026-67427 GHSA-hr7p-wg7r-hg9m

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

HIGH 76CWE-522Published 2026-07-29 · Updated 2026-07-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-522 and CWE-693.

Summary

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue is fixed in version 2.26.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00446 39th percentileScored 2026-11-07

Fix Fixed flyto-core (flytohub): 2.26.6flyto-core (PyPI): 2.26.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
flytohub	flyto-core	before 2.26.6	2.26.6	Patch available	CNA
—	flyto-core (PyPI)	before 2.26.7	2.26.7	Patch available	GHSA-hr7p-wg7r-hg9m

flyto-core Vendorflytohub Affected before 2.26.6 Fixed in 2.26.6 Patch available CNA
flyto-core (PyPI) Vendor— Affected before 2.26.7 Fixed in 2.26.7 Patch available GHSA-hr7p-wg7r-hg9m

Remediation

Fix · CNA flyto-core (flytohub) Fixed in 2.26.6
Fix · GHSA-hr7p-wg7r-hg9m flyto-core (PyPI) Fixed in 2.26.7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-67427
2026-10-03 Alias added: GHSA-hr7p-wg7r-hg9m

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-67427

Other 4

TI-2026-47709 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules) CVSS 3.1CRITICAL 10.0
TI-2026-47706 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration CVSS 3.1CRITICAL 9.3
TI-2026-47705 Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url CVSS 3.1HIGH 8.6
TI-2026-74172 Unauthenticated command execution in Flyto2 Core over HTTP MCP CVSS 3.1HIGH 8.4
TI-2026-47708 Server-side request forgery in flytohub flyto-core CVSS 3.1HIGH 8.5
TI-2026-47704 Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation CVSS 3.1HIGH 8.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences