Flyto Core CVE-2026-67428

Exploitation requires an authenticated low-privileged actor (CVSS PR:L) who can supply or influence the destination URL of at least one affected module - for example the url/webhook_url/provider_url/image base_url parameters of http.get, http.post, graphql.query/mutation, monitor.http_check, slack_send, the Discord/Slack/Teams notifications, ai.vision_analyze, verify.visual_diff, browser.proxy_rotate, or the agent/llm inline base_url branch. No user interaction is needed. Impact is maximized when Flyto Core runs on a cloud instance with a reachable metadata service (IMDSv1) or alongside internal-only services; limiting factors are the need for workflow-author/operator access (not anonymous), that only versions before 2.26.7 are vulnerable, and that egress filtering or IMDSv2 in front of the host materially reduces what an attacker can reach.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5) is internally consistent with a classic SSRF: network-reachable, low complexity, only low privileges (a workflow author/operator role), no user interaction, and a scope change reflecting that the confidentiality impact lands on systems other than the workflow engine itself. The PR:L requirement is the key limiter - this is not an anonymous internet-facing RCE but an abuse-of-feature by someone already permitted to define or run workflows, which meaningfully narrows the realistic attacker set. No EPSS score, no CISA KEV entry, and no POC were provided, so exploitation probability cannot be quantified from the input; the presence of a public fixing commit and GHSA advisory means the vulnerable code paths are disclosed even though weaponized exploit code is not confirmed. Net: a genuinely credible and easy-to-exploit issue in environments where untrusted or semi-trusted users author workflows (multi-tenant/SaaS), but lower urgency for single-tenant deployments where all workflow authors are already trusted. Because impact centers on cloud-metadata/internal-service exposure, real-world severity is amplified when Flyto Core runs inside a cloud instance with IMDSv1 reachable.

A low-privileged workflow author on a Flyto Core instance configures an ai.vision_analyze or http.get step with image_url/url set to http://169.254.169.254/latest/meta-data/iam/security-credentials/, and the server fetches it without SSRF validation, returning temporary cloud credentials into the workflow output. The same trick against graphql.query or slack_send webhook_url lets the attacker enumerate and reach internal-only services behind the engine. No public exploit code is identified, but the fixing commit publicly reveals every vulnerable caller.