EUVD-2026-50472
GHSA-pgwh-4jj4-qm8v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Network-reachable SSRF invocable by a low-privilege workflow author (PR:L, AC:L, no UI); scope changes to internal/metadata targets with high confidentiality and limited integrity, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/third_party/developer/http/requests.py, core.api.http_get, core.api.http_post, graphql.query, graphql.mutation, monitor.http_check, communication.slack_send, notification.discord.send_message, notification.slack.send_message, notification.teams.send_message, ai.vision_analyze, verify.visual_diff, browser.proxy_rotate, and the agent and llm inline base_url branch fetch caller-controlled URLs without validate_url_with_env_config, allowing SSRF to internal or metadata endpoints. This issue is fixed in version 2.26.7.
AnalysisAI
Server-side request forgery in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets a low-privileged workflow author coerce the server into fetching attacker-supplied URLs across a broad set of HTTP-emitting modules - http.get/post, GraphQL query/mutation, monitor.http_check, Slack/Discord/Teams notifications, ai.vision_analyze, browser.proxy_rotate, and the agent/LLM base_url branch - because these callers bypassed the existing validate_url_with_env_config SSRF guard. An authenticated attacker can pivot to internal-only services and cloud metadata endpoints (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated low-privileged actor (CVSS PR:L) who can supply or influence the destination URL of at least one affected module - for example the url/webhook_url/provider_url/image base_url parameters of http.get, http.post, graphql.query/mutation, monitor.http_check, slack_send, the Discord/Slack/Teams notifications, ai.vision_analyze, verify.visual_diff, browser.proxy_rotate, or the agent/llm inline base_url branch. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5) is internally consistent with a classic SSRF: network-reachable, low complexity, only low privileges (a workflow author/operator role), no user interaction, and a scope change reflecting that the confidentiality impact lands on systems other than the workflow engine itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged workflow author on a Flyto Core instance configures an ai.vision_analyze or http.get step with image_url/url set to http://169.254.169.254/latest/meta-data/iam/security-credentials/, and the server fetches it without SSRF validation, returning temporary cloud credentials into the workflow output. The same trick against graphql.query or slack_send webhook_url lets the attacker enumerate and reach internal-only services behind the engine. … |
| Remediation | Vendor-released patch: upgrade to Flyto Core 2.26.7, which adds enforce_outbound_url()/SSRFError gating to the previously-unguarded modules and revalidates redirect hops (see release https://github.com/flytohub/flyto-core/releases/tag/v2.26.7, advisory https://github.com/flytohub/flyto-core/security/advisories/GHSA-pgwh-4jj4-qm8v, and fix commit https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit workflow author access and restrict permissions to a documented set of trusted developers; disable HTTP-emitting modules (http.get/post, GraphQL, monitor.http_check, notification integrations, ai.vision_analyze, browser.proxy_rotate, LLM base_url) that are not essential to business operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Flyto Core
View allSecret exfiltration in Flyto Core (flytohub/flyto-core) before 2.26.6 arises because the workflow-engine variable resolv
Arbitrary file write in flytohub Flyto Core (the execution kernel for automation and AI-agent workflows) prior to 2.26.6
Unauthenticated SSRF and secret exfiltration in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets remote attackers c
Sensitive credential exposure in Flyto Core (flytohub/flyto-core) prior to 2.26.6 lets a remote actor exfiltrate the ope
Server-side request forgery in Flyto Core (flyto-core), an execution kernel for automation and AI-agent workflows, allow
Server-side request forgery guard bypass in Flyto Core (flyto-core) versions up to and including 2.27.0 allows authentic
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today