DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-67428: CVE-2026-67428: Server-Side Request Forgery in Flyto2 Core HTTP-Emitting Modules

#security #cve #cybersecurity

CVE-2026-67428: Server-Side Request Forgery in Flyto2 Core HTTP-Emitting Modules

Vulnerability ID: CVE-2026-67428
CVSS Score: 8.5
Published: 2026-07-30

Flyto2 Core (flyto-core) prior to version 2.26.7 did not utilize its centralized SSRF validation mechanism ('validate_url_with_env_config') across multiple HTTP-emitting modules. This oversight allowed low-privileged users executing automated workflows to perform Server-Side Request Forgery (SSRF) attacks against internal endpoints, loopback interfaces, and cloud provider metadata services.

TL;DR

Low-privileged users can execute arbitrary Server-Side Request Forgery (SSRF) attacks against cloud metadata endpoints and local networks due to unvalidated HTTP-emitting modules in Flyto2 Core.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network (AV:N)
  • CVSS Score: 8.5 (High)
  • EPSS Score: 0.00337 (26.26th percentile)
  • Impact: Server-Side Request Forgery / Internal Reconnaissance / Metadata Exfiltration
  • Exploit Status: PoC available, no active exploitation reported
  • KEV Status: Not Listed

Affected Systems

  • flyto-core
  • flyto-core: < 2.26.7 (Fixed in: 2.26.7)

Code Analysis

Commit: 0a0a528

Add standardized SSRF validation checks (enforce_outbound_url) to all HTTP-emitting modules and resolve HTTP redirect-based bypass.

Exploit Details

  • Security Researcher zx / Jace: Verified Proof-of-Concept delivered to the maintainers demonstrating cloud metadata access through workflow executors.

Mitigation Strategies

  • Upgrade to flyto-core version 2.26.7 or above
  • Enforce container network sandboxing to prevent egress to private host segments
  • Enforce IMDSv2 on cloud compute hosts with an HTTP hop limit of 1

Remediation Steps:

  1. Pull the latest Docker image or package release for flyto-core containing tag 2.26.7
  2. Rebuild worker execution instances to apply updated Python source dependencies
  3. Configure egress routing tables inside container hosts to explicitly drop packets aimed at local loopback interfaces and RFC 1918 networks
  4. Audit workflow system execution logs for keywords matching SSRF_BLOCKED to identify blocked malicious behavior

References

Read the full report for CVE-2026-67428 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)