DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-67424: CVE-2026-67424: Server-Side Request Forgery Bypass via Unvalidated Redirects in Flyto2 Core

#security #cve #cybersecurity

CVE-2026-67424: Server-Side Request Forgery Bypass via Unvalidated Redirects in Flyto2 Core

Vulnerability ID: CVE-2026-67424
CVSS Score: 8.5
Published: 2026-07-30

An SSRF vulnerability exists in Flyto2 Core due to improper validation of intermediate HTTP redirect hops. While the initial request target is validated against an SSRF protection policy, the HTTP client library (aiohttp) transparently follows 30x redirects to local, internal, or cloud metadata endpoints without application-level revalidation.

TL;DR

Flyto2 Core follows HTTP redirects to private internal subnets without revalidating intermediate URLs, leading to an SSRF vulnerability (CVSS 8.5).

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network
  • CVSS Base Score: 8.5
  • EPSS Score: 0.00236
  • EPSS Percentile: 14.80%
  • Exploit Status: poc
  • KEV Status: Not listed

Affected Systems

  • Flyto2 Core execution kernel (flyto-core)
  • flyto-core: < 2.26.7 (Fixed in: 2.26.7)

Code Analysis

Commit: 0a0a528

Hardening commit disabling direct library redirects and introducing guarded manual validation for redirection loops

Exploit Details

Mitigation Strategies

  • Upgrade the flyto-core library to version 2.26.7 or newer to enforce hop-by-hop validation.
  • Apply strict firewall egress rules on runner nodes to block outbound requests to private network subnets.
  • Configure cloud instance metadata services (IMDS) to require session tokens (IMDSv2) to mitigate generic, credential-grabbing SSRF attacks.

Remediation Steps:

  1. Identify all active deployments running flyto-core versions older than 2.26.7.
  2. Run the pip upgrade command: pip install --upgrade flyto-core>=2.26.7
  3. Validate the configuration of the SSRF guard utility variables within the environment config file.
  4. Restart active execution runner daemons to load the updated validation logic.

References

Read the full report for CVE-2026-67424 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)