What is the CVSS score of EUVD-2026-50471?

EUVD-2026-50471 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Flyto Core are affected by EUVD-2026-50471?

Flyto Core before version 2.26.6 contains a vulnerability allowing attackers to steal host environment credentials and secrets by manipulating workflow parameters, potentially compromising all…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-50471?

Yes, a public proof-of-concept exploit is available for EUVD-2026-50471. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-50471?

Within 24 hours, inventory all systems running Flyto Core and identify instances using versions prior to 2.26.6. Within 7 days, upgrade all affected instances to Flyto Core version 2.26.6 or later. Within 30 days, audit Flyto Core workflow execution logs for suspicious parameter patterns attempting to access environment variables, and rotate any host-level credentials as a precautionary measure.

Flyto Core EUVD-2026-50471

| CVE-2026-67427 HIGH

Insufficiently Protected Credentials (CWE-522)

2026-07-29 GitHub_M

GHSA-hr7p-wg7r-hg9m

Authentication Bypass Flyto Core

8.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Env interpolation is reachable via a network-supplied workflow parameter with no auth in agentic use (AV:N/PR:N/AC:L); secrets cross the sandbox boundary into host env, giving S:C and C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 29, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jul 29, 2026 - 19:21 vuln.today

Analysis Generated

Jul 29, 2026 - 19:21 vuln.today

CVE Published

Jul 29, 2026 - 18:45 cve.org

HIGH 8.6

DescriptionCVE.org

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue is fixed in version 2.26.6.

AnalysisAI

Secret exfiltration in Flyto Core (flytohub/flyto-core) before 2.26.6 arises because the workflow-engine variable resolver expands ${env.VAR} for any host environment variable with no allowlist or capability-policy check. Because interpolation runs in the engine before the module chokepoint, an attacker who can influence a workflow parameter can read arbitrary host secrets even when the env.get and env.load_dotenv modules are explicitly denylisted, then leak them through modules that are still allowed. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Influence a workflow parameter

Delivery

Inject ${env.SECRET} token

Exploit

Resolver expands host env var pre-policy

Execution

Bypass env.get denylist

Persist

Secret inlined into allowed module

Impact

Exfiltrate credentials off-host

Access

Influence a workflow parameter

Delivery

Inject ${env.SECRET} token

Exploit

Resolver expands host env var pre-policy

Execution

Bypass env.get denylist

Persist

Secret inlined into allowed module

Impact

Exfiltrate credentials off-host

Vulnerability AssessmentAI

Exploitation	Exploitation requires two things: (1) the operator relies on the capability policy denylist for env.get / env.load_dotenv to protect host secrets (the default posture the advisory describes), and (2) the attacker can place a ${env.VAR} token into a workflow step parameter that passes through the engine's variable resolver. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) portrays a high-severity, unauthenticated, low-complexity, confidentiality-only issue with scope change - consistent with a sandbox-escape that reaches host secrets. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can influence a workflow parameter (for example, untrusted content processed by an AI-agent workflow, or a submitted job in a multi-tenant automation setup) inserts ${env.AWS_SECRET_ACCESS_KEY} or ${env.OPENAI_API_KEY} into a field. The engine's variable resolver expands it against the host environment before the module policy runs, so even though env.get is denylisted the secret is inlined and then carried out through an allowed module (e.g. …
Remediation	Vendor-released patch: 2.26.6 - upgrade flyto-core to 2.26.6 or later, which gates ${env.*} interpolation through the same policy as the env.get module (deny-by-default) per GHSA-hr7p-wg7r-hg9m. … Detailed patch versions, workarounds, and compensating controls in full report.