CyberRota Analysis
AI-GeneratedThe Flyto2 Core execution kernel is vulnerable due to improper validation of HTTP redirects in its modules, which can allow attackers to exploit the system by redirecting requests to internal addresses and retrieving sensitive internal data. This high-severity vulnerability (CVSS 8.5) poses a significant risk to organizations using versions prior to 2.26.7, particularly those handling sensitive data or operating in regulated environments. Users of affected versions should prioritize upgrading to version 2.26.7 to mitigate potential data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial URL, then follow redirects with allow_redirects=True and without per-hop Location revalidation, allowing a public URL to redirect into internal address space and return the internal response body. This issue is fixed in version 2.26.7.