Read the docs
TI-2026-47708 Aliases CVE-2026-67428GHSA-pgwh-4jj4-qm8v

Server-side request forgery in flytohub flyto-core

Priority HIGH 70CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/third_party/developer/http/requests.py, core.api.http_get, core.api.http_post, graphql.query, graphql.mutation, monitor.http_check, communication.slack_send, notification.discord.send_message, notification.slack.send_message, notification.teams.send_message, ai.vision_analyze, verify.visual_diff, browser.proxy_rotate, and the agent and llm inline base_url branch fetch caller-controlled URLs without validate_url_with_env_config, allowing SSRF to internal or metadata endpoints. This issue is fixed in version 2.26.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00409 35th percentileScored 2026-11-07
Fix Fixed flyto-core (flytohub): 2.26.7flyto-core (PyPI): 2.26.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flytohubflyto-corebefore 2.26.72.26.7Patch availableCNA
—flyto-core (PyPI)before 2.26.72.26.7Patch availableGHSA-pgwh-4jj4-qm8v
  • flyto-core Vendorflytohub Affected before 2.26.7 Fixed in 2.26.7 Patch available CNA
  • flyto-core (PyPI) Vendor— Affected before 2.26.7 Fixed in 2.26.7 Patch available GHSA-pgwh-4jj4-qm8v

Remediation

  • Fix · CNA flyto-core (flytohub) Fixed in 2.26.7
  • Fix · GHSA-pgwh-4jj4-qm8v flyto-core (PyPI) Fixed in 2.26.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-67428
  2. 2026-10-03 Alias added: GHSA-pgwh-4jj4-qm8v

References

Advisory 1

Other 4

  • TI-2026-47709 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules) CVSS 3.1CRITICAL 10.0
  • TI-2026-47706 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration CVSS 3.1CRITICAL 9.3
  • TI-2026-47707 Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted CVSS 3.1HIGH 8.6
  • TI-2026-47705 Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url CVSS 3.1HIGH 8.6
  • TI-2026-74172 Unauthenticated command execution in Flyto2 Core over HTTP MCP CVSS 3.1HIGH 8.4
  • TI-2026-47704 Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation CVSS 3.1HIGH 8.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences