EUVD-2026-50470
GHSA-jx74-cqjv-2c67
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Unauthenticated network endpoint with no user interaction gives AV:N/AC:L/PR:N/UI:N; SSRF reaching other systems plus leaked runner secret give S:C and C:H, with limited I:L and no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url for an outbound POST with X-Internal-Key: $FLYTO_RUNNER_SECRET while bypassing target_allowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7.
AnalysisAI
Unauthenticated SSRF and secret exfiltration in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets remote attackers coerce the standalone flyto-verification service into making attacker-directed outbound requests. The service listens on 0.0.0.0:8344 with no authentication and accepts a client-supplied callback_url, then issues an outbound POST carrying the X-Internal-Key: $FLYTO_RUNNER_SECRET header while skipping the target_allowed allowlist, so an attacker can both reach internal-only endpoints and steal the runner secret. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the standalone flyto-verification service (src/core/verification_service.py) is running and its POST /run listener on 0.0.0.0:8344 is network-reachable by the attacker; the endpoint is unauthenticated (PR:N) and needs no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high priority, not a paper tiger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach TCP 8344 sends an unauthenticated POST /run to the flyto-verification service with a callback_url pointing at a server they control. The service performs an outbound POST to that URL including the X-Internal-Key header containing FLYTO_RUNNER_SECRET, handing the attacker the runner secret; alternatively the attacker points callback_url at an internal address (e.g. … |
| Remediation | Vendor-released patch: 2.26.7 - upgrade flyto-core to 2.26.7 or later, which is the definitive fix (release https://github.com/flytohub/flyto-core/releases/tag/v2.26.7, advisory https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67, fix commit 0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Flyto Core deployments in your environment and determine which versions are running; immediately network-isolate the flyto-verification service (port 8344) to authorized systems only and enable monitoring for unexpected outbound connections. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Flyto Core
View allSecret exfiltration in Flyto Core (flytohub/flyto-core) before 2.26.6 arises because the workflow-engine variable resolv
Arbitrary file write in flytohub Flyto Core (the execution kernel for automation and AI-agent workflows) prior to 2.26.6
Sensitive credential exposure in Flyto Core (flytohub/flyto-core) prior to 2.26.6 lets a remote actor exfiltrate the ope
Server-side request forgery in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets a low-privileged workflow author co
Server-side request forgery in Flyto Core (flyto-core), an execution kernel for automation and AI-agent workflows, allow
Server-side request forgery guard bypass in Flyto Core (flyto-core) versions up to and including 2.27.0 allows authentic
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today