DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-67427: CVE-2026-67427: Host Environment Variable Access Policy Bypass via Template Interpolation in Flyto2 Core

#security #cve #cybersecurity

CVE-2026-67427: Host Environment Variable Access Policy Bypass via Template Interpolation in Flyto2 Core

Vulnerability ID: CVE-2026-67427
CVSS Score: 8.6
Published: 2026-07-30

CVE-2026-67427 is a capability bypass vulnerability in the Flyto2 Core workflow execution kernel. Due to a logical inconsistency in how dynamic parameters are resolved, the system evaluates environment variables via template interpolation prior to executing capability filter validation. This permits unprivileged workflow definitions to completely bypass denylist restrictions on the env.get module, exfiltrating critical host configurations, API tokens, and credentials via allowed communication channels.

TL;DR

A logical separation-of-duty flaw in Flyto2 Core's parser allows workflows to bypass security policies. By embedding '${env.VARIABLE}' template strings inside allowed modules, attackers can extract system-level credentials without trigger-blocking module denylists.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-693 (Protection Mechanism Failure)
  • Attack Vector: Network
  • CVSS v3.1 Score: 8.6 (High)
  • EPSS Score: 0.00339 (Percentile: 26.51%)
  • Impact: Information Disclosure (Host Secret Extraction)
  • Exploit Status: Proof-of-Concept / Technical Analysis
  • KEV Status: Not Listed

Affected Systems

  • Flyto2 Core
  • flyto-core: < 2.26.6 (Fixed in: 2.26.6)

Code Analysis

Commit: d5f89d7

Secure sandbox directories, credential endpoints, and ${env.*} interpolation.

Exploit Details

Mitigation Strategies

  • Upgrade flyto-core to version 2.26.6 or higher.
  • Define explicit environment variable boundaries using the newly introduced FLYTO_ENV_VAR_ALLOWLIST variable.
  • Isolate automation container runtimes and limit the configuration variables exposed to host processes.

Remediation Steps:

  1. Identify all production and test environments running flytohub/flyto-core versions below 2.26.6.
  2. Update project configuration files and build specifications to require version 2.26.6.
  3. Apply the FLYTO_ENV_VAR_ALLOWLIST environment variable in service deployment manifests to restrict dynamic template resolution.
  4. Review historical workflow execution records and audit logs for patterns resembling dynamic variable interpolation calls.

References

Read the full report for CVE-2026-67427 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)