CVE-2026-67426 | CyberRota

CyberRota Analysis

AI-Generated

The Flyto2 Core execution kernel is vulnerable due to an unauthenticated POST endpoint that allows attackers to exploit server-side request forgery (SSRF) and exfiltrate sensitive runner secrets. This critical vulnerability affects versions prior to 2.26.7 and poses a significant risk to any organization using the affected software for automation and AI workflows. Users of Flyto2 Core should prioritize upgrading to version 2.26.7 to mitigate potential security breaches.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-67426

Severity

CRITICAL

CVSS

9.3

EPSS

0.31%

Original NVD Description

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url for an outbound POST with X-Internal-Key: $FLYTO_RUNNER_SECRET while bypassing target_allowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7.