CVE-2026-67425 in flyto-core
Summary
by MITRE • 07/29/2026
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from the environment and sends them in the Authorization: Bearer header to caller-controlled base_url, allowing an attacker to receive the operator's key on a public host that passes the SSRF guard. This issue is fixed in version 2.26.6.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The Flyto2 Core execution kernel represents a critical security vulnerability in its handling of API credentials within automation and AI-agent workflows. This flaw exists in versions prior to 2.26.6 where the system processes environment variables containing sensitive provider keys including OPENAI_API_KEY and ANTHROPIC_API_KEY without adequate validation or sanitization. The vulnerability manifests when these credentials are transmitted through the Authorization: Bearer header to a caller-controlled base_url parameter, creating an exploitable path for unauthorized access to operational resources.
The technical implementation of this flaw demonstrates a classic server-side request forgery vulnerability that operates through environment variable leakage and improper input validation. When the llm.chat component processes requests, it directly incorporates environment variables into HTTP headers without checking the destination URL against a whitelist or validating the target endpoint. This creates an opportunity for attackers to manipulate the base_url parameter to point to a malicious server they control, thereby intercepting the transmitted bearer tokens containing the sensitive API keys.
The operational impact of this vulnerability extends beyond simple credential theft, as it enables persistent unauthorized access to downstream AI services and cloud computing resources. Attackers who successfully exploit this vulnerability can gain access to large language model APIs, potentially consuming compute resources, accessing proprietary data, or performing actions that compromise the integrity and confidentiality of automated workflows. The security implications are particularly severe because these API keys typically provide access to high-value resources with extensive computational capabilities.
This vulnerability aligns with CWE-918 Server-Side Request Forgery and maps to ATT&CK technique T1071.004 Application Layer Protocol: DNS, where attackers leverage protocol manipulation to bypass security controls. The flaw represents a failure in input validation and access control mechanisms that should prevent arbitrary URL resolution of sensitive data transmission paths. Organizations utilizing Flyto2 Core versions prior to 2.26.6 face significant risk of credential compromise and potential service abuse, particularly in environments where automated workflows process sensitive business or personal data through third-party AI services.
The fix implemented in version 2.26.6 addresses the core issue by strengthening input validation for base_url parameters and implementing proper credential handling that prevents environment variable leakage to untrusted endpoints. This update ensures that API keys are only transmitted to validated, legitimate service endpoints while maintaining the system's functionality for automated workflow execution. Organizations should immediately upgrade to version 2.26.6 or later to remediate this vulnerability and conduct thorough security reviews of their automation workflows to identify any potential exploitation attempts that may have occurred prior to the fix deployment.