DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-67426: CVE-2026-67426: Unauthenticated Remote Code Execution and Secret Exfiltration in Flyto2 Core

#security #cve #cybersecurity

CVE-2026-67426: Unauthenticated Remote Code Execution and Secret Exfiltration in Flyto2 Core

Vulnerability ID: CVE-2026-67426
CVSS Score: 9.3
Published: 2026-07-30

CVE-2026-67426 is a critical vulnerability in Flyto2 Core prior to version 2.26.7. The standalone flyto-verification service binds to all interfaces (0.0.0.0) on port 8344 and exposes an unauthenticated POST /run endpoint. This endpoint accepts an arbitrary client-controlled callback URL and makes an outbound POST request containing the sensitive internal runner secret in the headers. Attackers can exploit this to retrieve the FLYTO_RUNNER_SECRET and perform Server-Side Request Forgery (SSRF) against internal network targets.

TL;DR

The flyto-verification service exposed an unauthenticated endpoint that sent internal runner secrets to arbitrary callback URLs, facilitating credential exfiltration and SSRF.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-306, CWE-918, CWE-522
  • Attack Vector: Network
  • CVSS Base Score: 9.3
  • EPSS Score: 0.00291 (0.29%)
  • Exploit Status: poc
  • KEV Status: not listed
  • Affected Component: flyto-verification service (port 8344)

Affected Systems

  • Flyto2 Core
  • flyto-core: < 2.26.7 (Fixed in: 2.26.7)

Code Analysis

Commit: 0a0a528

Add token authentication to verification run endpoint, validate callback destinations against trusted hosts, and prevent credential exfiltration SSRF vectors.

Exploit Details

  • GitHub Security Advisory: Official advisory details regarding the unauthenticated run route and callback credential leak.

Mitigation Strategies

  • Update flyto-core to version 2.26.7 or newer.
  • Bind port 8344 exclusively to local network interfaces or trusted internal container subnets.
  • Configure the FLYTO_VERIFICATION_API_KEY environment variable to enable token comparison checks.
  • Use FLYTO_TRUSTED_CALLBACK_HOSTS to limit authorized callback endpoints.

Remediation Steps:

  1. Identify all deployment instances running flyto-core versions prior to v2.26.7.
  2. Modify deployment configuration files or docker-compose files to pull flyto-core:2.26.7 or higher.
  3. Inject environment variable FLYTO_VERIFICATION_API_KEY with a secure, randomly generated alphanumeric string.
  4. Configure the FLYTO_ENGINE_URL and FLYTO_TRUSTED_CALLBACK_HOSTS environment variables to reflect trusted services.
  5. Deploy network security groups or local firewall rules (iptables/ufw) to drop external traffic attempting to connect to TCP port 8344.
  6. Restart the flyto-verification containers to apply the patched binary and environment configurations.

References

Read the full report for CVE-2026-67426 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)