EUVD-2026-50468
GHSA-qq9q-xgm3-xv9g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-delivered secret exfiltration with a scope change to an attacker-controlled system (S:C, C:H); PR:L because influencing the base_url/workflow generally needs some access, and no integrity/availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from the environment and sends them in the Authorization: Bearer header to caller-controlled base_url, allowing an attacker to receive the operator's key on a public host that passes the SSRF guard. This issue is fixed in version 2.26.6.
AnalysisAI
Sensitive credential exposure in Flyto Core (flytohub/flyto-core) prior to 2.26.6 lets a remote actor exfiltrate the operator's LLM provider API keys: the llm.chat/ai_model path reads OPENAI_API_KEY and ANTHROPIC_API_KEY from the host environment and forwards them verbatim in an Authorization: Bearer header to a caller-controlled base_url. By supplying a public endpoint that satisfies the existing SSRF guard, an attacker collects the key on their own host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that (1) the operator has provisioned real provider keys such as OPENAI_API_KEY or ANTHROPIC_API_KEY in the host environment, (2) the attacker can cause llm.chat/ai_model to run with a caller-controlled base_url (via a crafted workflow step or injected instructions to an AI agent), and (3) the chosen endpoint is a public host that satisfies the pre-existing SSRF guard. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) reflects a network-reachable, low-complexity issue with a scope change (S:C) because the secret crosses a trust boundary to a system the attacker controls, and high confidentiality impact with no integrity or availability effect - consistent with a credential-disclosure bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can influence a Flyto Core workflow - for example through prompt injection into an AI-agent step or by submitting a workflow that sets llm.chat's base_url - points base_url at a public server they control that passes the SSRF guard. When the workflow runs, the engine attaches the operator's OPENAI_API_KEY/ANTHROPIC_API_KEY as an Authorization: Bearer header and the attacker's server logs the incoming credential. … |
| Remediation | Vendor-released patch: upgrade to Flyto Core 2.26.6, which contains the fix commit d5f89d71303e3c1e6418d347c5c55fcd173cc8cc and blocks forwarding env-derived provider keys to caller-supplied endpoints (see advisory GHSA-qq9q-xgm3-xv9g at https://github.com/flytohub/flyto-core/security/advisories/GHSA-qq9q-xgm3-xv9g and release https://github.com/flytohub/flyto-core/releases/tag/v2.26.6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Flyto Core deployments running versions prior to 2.26.6 and confirm whether OPENAI_API_KEY and ANTHROPIC_API_KEY are present in environment variables on affected hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Flyto Core
View allSecret exfiltration in Flyto Core (flytohub/flyto-core) before 2.26.6 arises because the workflow-engine variable resolv
Arbitrary file write in flytohub Flyto Core (the execution kernel for automation and AI-agent workflows) prior to 2.26.6
Unauthenticated SSRF and secret exfiltration in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets remote attackers c
Server-side request forgery in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets a low-privileged workflow author co
Server-side request forgery in Flyto Core (flyto-core), an execution kernel for automation and AI-agent workflows, allow
Server-side request forgery guard bypass in Flyto Core (flyto-core) versions up to and including 2.27.0 allows authentic
Share
External POC / Exploit Code
Leaving vuln.today