EUVD-2026-50465
GHSA-c9hr-64h3-gxpc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Network-reachable SSRF invokable by a low-privileged user (PR:L), no user interaction, scope changes into an internal context (S:C) with high read of internal data (C:H) and limited integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial URL, then follow redirects with allow_redirects=True and without per-hop Location revalidation, allowing a public URL to redirect into internal address space and return the internal response body. This issue is fixed in version 2.26.7.
AnalysisAI
Server-side request forgery in Flyto Core (flyto-core), an execution kernel for automation and AI-agent workflows, allows a low-privileged user who supplies a URL to the http.get, http.request, or http.batch modules to reach internal-only services. Prior to 2.26.7 these modules validated only the initial URL and then followed HTTP redirects (allow_redirects=True) without revalidating each Location hop, so a permitted public URL can 302-redirect into internal address space and return the internal response body to the caller. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be able to invoke one of the http.get, http.request, or http.batch modules and control the target URL passed to it, which per the CVSS PR:L implies an authenticated low-privileged account (or an AI-agent workflow whose URL input the attacker can influence). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5) indicates network-reachable, low-complexity exploitation by an authenticated low-privileged actor with a changed scope and high confidentiality impact - consistent with SSRF that pivots into a separate internal security context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user (or an AI agent acting on attacker-influenced input) invokes http.get against an attacker-controlled external URL that passes the initial allowlist check. That server responds with a 302 redirect to http://169.254.169.254/ or an internal service; because redirect hops are not revalidated, Flyto Core follows it and returns the internal response body to the attacker, exposing cloud credentials or internal data. … |
| Remediation | Vendor-released patch: upgrade to Flyto Core 2.26.7, which adds per-redirect-hop SSRF revalidation via guarded_aiohttp_request (commit 0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Flyto Core deployments and identify those running versions prior to 2.26.7, then review logs for http.get, http.request, and http.batch calls targeting internal IP ranges or services that may indicate exploitation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Flyto Core
View allSecret exfiltration in Flyto Core (flytohub/flyto-core) before 2.26.6 arises because the workflow-engine variable resolv
Arbitrary file write in flytohub Flyto Core (the execution kernel for automation and AI-agent workflows) prior to 2.26.6
Unauthenticated SSRF and secret exfiltration in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets remote attackers c
Sensitive credential exposure in Flyto Core (flytohub/flyto-core) prior to 2.26.6 lets a remote actor exfiltrate the ope
Server-side request forgery in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets a low-privileged workflow author co
Server-side request forgery guard bypass in Flyto Core (flyto-core) versions up to and including 2.27.0 allows authentic
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today