Unauthenticated SSRF and secret exfiltration in Flyto2 Core verification service (CVE-2026-67426)

The standalone flyto-verification service in Flyto2 Core exposes an unauthenticated POST /run endpoint bound to all interfaces on port 8344. An attacker-supplied callback_url is used verbatim for an outbound POST that unconditionally attaches the internal runner secret (X-Internal-Key: $FLYTO_RUNNER_SECRET), bypassing the service's target_allowed allowlist entirely. This enables unauthenticated server-side request forgery to internal or cloud-metadata endpoints and exfiltration of the runner secret, which can then be used to forge authenticated callbacks to the real engine. Public POC available. Affected versions: - <= 2.26.6 We recommend updating to: 2.26.7. CVSS 9.3 · our assessment: act_now Reference: https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67 Details: https://vuln.today/cve/CVE-2026-67426