Flyto Core
Monthly
Server-side request forgery guard bypass in Flyto Core (flyto-core) versions up to and including 2.27.0 allows authenticated low-privilege attackers to reach internal network services by supplying the IPv6 unspecified address `::`, which the OS kernel routes to loopback identically to `0.0.0.0`. The `is_private_ip()` guard function fails to classify `::` or its expanded spellings as private, and the bypass is also reachable via attacker-controlled 302 redirects, meaning the attack surface spans the `http.get`, `http.request`, and `http.batch` modules. A vendor-released patch is available in v2.28.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file write in flytohub Flyto Core (the execution kernel for automation and AI-agent workflows) prior to 2.26.6 lets attacker-influenced response bytes be written to any filesystem path the process can reach, because image.download and sibling file-writing modules trust a caller-controlled output_dir instead of routing it through validate_path_with_env_config and the FLYTO_SANDBOX_DIR sandbox. The flaw carries a CVSS 10.0 (scope-changed, high integrity and availability impact) and is fixed in v2.26.6. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets a low-privileged workflow author coerce the server into fetching attacker-supplied URLs across a broad set of HTTP-emitting modules - http.get/post, GraphQL query/mutation, monitor.http_check, Slack/Discord/Teams notifications, ai.vision_analyze, browser.proxy_rotate, and the agent/LLM base_url branch - because these callers bypassed the existing validate_url_with_env_config SSRF guard. An authenticated attacker can pivot to internal-only services and cloud metadata endpoints (e.g. 169.254.169.254), yielding high-confidence disclosure of internal data and credentials. There is no public exploit identified at time of analysis, but the upstream fixing commit is public, and no EPSS or CISA KEV data was supplied.
Secret exfiltration in Flyto Core (flytohub/flyto-core) before 2.26.6 arises because the workflow-engine variable resolver expands ${env.VAR} for any host environment variable with no allowlist or capability-policy check. Because interpolation runs in the engine before the module chokepoint, an attacker who can influence a workflow parameter can read arbitrary host secrets even when the env.get and env.load_dotenv modules are explicitly denylisted, then leak them through modules that are still allowed. No public exploit identified at time of analysis; the vendor commit and GHSA advisory confirm the flaw and its fix in 2.26.6. CVSS 8.6 with a scope change (CVSS:3.1/S:C/C:H) reflects that impact crosses the intended sandbox boundary into the host credential store.
Unauthenticated SSRF and secret exfiltration in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets remote attackers coerce the standalone flyto-verification service into making attacker-directed outbound requests. The service listens on 0.0.0.0:8344 with no authentication and accepts a client-supplied callback_url, then issues an outbound POST carrying the X-Internal-Key: $FLYTO_RUNNER_SECRET header while skipping the target_allowed allowlist, so an attacker can both reach internal-only endpoints and steal the runner secret. Rated CVSS 9.3 (scope-changed). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the fix and root cause are fully documented in the vendor GHSA advisory and patch commit.
Sensitive credential exposure in Flyto Core (flytohub/flyto-core) prior to 2.26.6 lets a remote actor exfiltrate the operator's LLM provider API keys: the llm.chat/ai_model path reads OPENAI_API_KEY and ANTHROPIC_API_KEY from the host environment and forwards them verbatim in an Authorization: Bearer header to a caller-controlled base_url. By supplying a public endpoint that satisfies the existing SSRF guard, an attacker collects the key on their own host. There is no public exploit identified at time of analysis and no CISA KEV listing; the flaw is fixed in 2.26.6, which adds an env-derived-credential endpoint check.
Server-side request forgery in Flyto Core (flyto-core), an execution kernel for automation and AI-agent workflows, allows a low-privileged user who supplies a URL to the http.get, http.request, or http.batch modules to reach internal-only services. Prior to 2.26.7 these modules validated only the initial URL and then followed HTTP redirects (allow_redirects=True) without revalidating each Location hop, so a permitted public URL can 302-redirect into internal address space and return the internal response body to the caller. There is no public exploit identified at time of analysis, but the fix is confirmed in release 2.26.7.
Server-side request forgery guard bypass in Flyto Core (flyto-core) versions up to and including 2.27.0 allows authenticated low-privilege attackers to reach internal network services by supplying the IPv6 unspecified address `::`, which the OS kernel routes to loopback identically to `0.0.0.0`. The `is_private_ip()` guard function fails to classify `::` or its expanded spellings as private, and the bypass is also reachable via attacker-controlled 302 redirects, meaning the attack surface spans the `http.get`, `http.request`, and `http.batch` modules. A vendor-released patch is available in v2.28.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file write in flytohub Flyto Core (the execution kernel for automation and AI-agent workflows) prior to 2.26.6 lets attacker-influenced response bytes be written to any filesystem path the process can reach, because image.download and sibling file-writing modules trust a caller-controlled output_dir instead of routing it through validate_path_with_env_config and the FLYTO_SANDBOX_DIR sandbox. The flaw carries a CVSS 10.0 (scope-changed, high integrity and availability impact) and is fixed in v2.26.6. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets a low-privileged workflow author coerce the server into fetching attacker-supplied URLs across a broad set of HTTP-emitting modules - http.get/post, GraphQL query/mutation, monitor.http_check, Slack/Discord/Teams notifications, ai.vision_analyze, browser.proxy_rotate, and the agent/LLM base_url branch - because these callers bypassed the existing validate_url_with_env_config SSRF guard. An authenticated attacker can pivot to internal-only services and cloud metadata endpoints (e.g. 169.254.169.254), yielding high-confidence disclosure of internal data and credentials. There is no public exploit identified at time of analysis, but the upstream fixing commit is public, and no EPSS or CISA KEV data was supplied.
Secret exfiltration in Flyto Core (flytohub/flyto-core) before 2.26.6 arises because the workflow-engine variable resolver expands ${env.VAR} for any host environment variable with no allowlist or capability-policy check. Because interpolation runs in the engine before the module chokepoint, an attacker who can influence a workflow parameter can read arbitrary host secrets even when the env.get and env.load_dotenv modules are explicitly denylisted, then leak them through modules that are still allowed. No public exploit identified at time of analysis; the vendor commit and GHSA advisory confirm the flaw and its fix in 2.26.6. CVSS 8.6 with a scope change (CVSS:3.1/S:C/C:H) reflects that impact crosses the intended sandbox boundary into the host credential store.
Unauthenticated SSRF and secret exfiltration in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets remote attackers coerce the standalone flyto-verification service into making attacker-directed outbound requests. The service listens on 0.0.0.0:8344 with no authentication and accepts a client-supplied callback_url, then issues an outbound POST carrying the X-Internal-Key: $FLYTO_RUNNER_SECRET header while skipping the target_allowed allowlist, so an attacker can both reach internal-only endpoints and steal the runner secret. Rated CVSS 9.3 (scope-changed). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the fix and root cause are fully documented in the vendor GHSA advisory and patch commit.
Sensitive credential exposure in Flyto Core (flytohub/flyto-core) prior to 2.26.6 lets a remote actor exfiltrate the operator's LLM provider API keys: the llm.chat/ai_model path reads OPENAI_API_KEY and ANTHROPIC_API_KEY from the host environment and forwards them verbatim in an Authorization: Bearer header to a caller-controlled base_url. By supplying a public endpoint that satisfies the existing SSRF guard, an attacker collects the key on their own host. There is no public exploit identified at time of analysis and no CISA KEV listing; the flaw is fixed in 2.26.6, which adds an env-derived-credential endpoint check.
Server-side request forgery in Flyto Core (flyto-core), an execution kernel for automation and AI-agent workflows, allows a low-privileged user who supplies a URL to the http.get, http.request, or http.batch modules to reach internal-only services. Prior to 2.26.7 these modules validated only the initial URL and then followed HTTP redirects (allow_redirects=True) without revalidating each Location hop, so a permitted public URL can 302-redirect into internal address space and return the internal response body to the caller. There is no public exploit identified at time of analysis, but the fix is confirmed in release 2.26.7.