CVE-2026-67428 in flyto-core
Summary
by MITRE • 07/29/2026
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/third_party/developer/http/requests.py, core.api.http_get, core.api.http_post, graphql.query, graphql.mutation, monitor.http_check, communication.slack_send, notification.discord.send_message, notification.slack.send_message, notification.teams.send_message, ai.vision_analyze, verify.visual_diff, browser.proxy_rotate, and the agent and llm inline base_url branch fetch caller-controlled URLs without validate_url_with_env_config, allowing SSRF to internal or metadata endpoints. This issue is fixed in version 2.26.7.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability exists within Flyto2 Core execution kernel where multiple HTTP-emitting modules fail to properly validate user-supplied URLs before making network requests. The flaw affects critical components including http_get, http_post, graphql operations, monitoring checks, and various communication modules that interface with external services like Slack, Discord, and Microsoft Teams. The root cause stems from the absence of proper URL validation functions such as validate_url_with_env_config when processing caller-controlled input parameters. This design oversight creates a server-side request forgery vulnerability that allows attackers to manipulate HTTP requests to target internal network resources or metadata endpoints that should remain inaccessible to external entities.
The technical implementation of this vulnerability spans across multiple modules within the core framework, including third-party developer HTTP request handling, GraphQL query and mutation execution paths, and various notification systems. When these modules process user-provided URLs without proper validation, they effectively bypass security controls designed to restrict network access to specific domains or internal resources. The impact is particularly severe because these modules can be invoked through automation workflows, AI-agent processes, and direct API calls, providing multiple attack vectors for exploitation. This vulnerability directly maps to CWE-918 Server-Side Request Forgery and aligns with ATT&CK technique T1071.004 Application Layer Protocol: DNS, where adversaries leverage such flaws to access internal services.
The operational consequences of this SSRF vulnerability are significant as it enables attackers to potentially access internal systems, metadata services, cloud instance metadata, or other sensitive resources that should be isolated from external network access. An attacker could exploit this to enumerate internal services, access configuration data, or even escalate privileges by reaching internal authentication systems or databases through the metadata endpoints. The impact extends beyond simple information disclosure as it provides a potential foothold for further compromise of the system infrastructure. Organizations using Flyto2 Core versions prior to 2.26.7 face substantial risk of internal network reconnaissance and lateral movement attacks that could lead to complete system compromise.
The fix implemented in version 2.26.7 addresses this vulnerability by ensuring proper URL validation through the validate_url_with_env_config function across all affected HTTP-emitting modules. This remediation follows established security best practices for preventing SSRF attacks by implementing strict input validation and whitelisting mechanisms for network requests. Organizations should immediately upgrade to version 2.26.7 or later to mitigate this risk, while also implementing additional monitoring of HTTP request patterns to detect potential exploitation attempts. The vulnerability demonstrates the critical importance of validating all user-supplied inputs in network-facing applications and highlights the necessity of comprehensive security testing across all modules that handle external communications within automation and AI-agent frameworks.