DEV Community: CVE Reports

CVE-2026-67439: CVE-2026-67439: Incorrect Authorization Leading to Log Leak in OliveTin

CVE Reports — Fri, 31 Jul 2026 09:30:29 +0000

CVE-2026-67439: Incorrect Authorization Leading to Log Leak in OliveTin

Vulnerability ID: CVE-2026-67439
CVSS Score: 4.3
Published: 2026-07-30

An incorrect authorization vulnerability (CWE-863) exists in OliveTin prior to version 3000.17.0. The flaw allows authenticated users who are authorized to execute commands but restricted from viewing logs to bypass this restriction. By utilizing synchronous endpoints, attackers can directly access execution outputs containing sensitive system data, credentials, and environmental configurations.

TL;DR

OliveTin failed to validate log-viewing permissions on synchronous execution endpoints, leaking sensitive shell outputs to restricted users.

Technical Details

CWE ID: CWE-863 (Incorrect Authorization)
Attack Vector: Network (AV:N)
Privileges Required: Low (PR:L)
CVSS v3.1 Score: 4.3 (Medium)
EPSS Score: 0.00252 (Percentile: 16.75%)
Exploit Status: None (No public PoC)
CISA KEV Status: Not Listed

Affected Systems

OliveTin Core Server
OliveTin: >= 3000.7.0, < 3000.17.0 (Fixed in: 3000.17.0)

Code Analysis

Commit: e421780

Fix log ACL bypass in synchronous actions

--- a/service/internal/api/api.go
+++ b/service/internal/api/api.go
@@ -282,6 +282,21 @@ func (api *oliveTinAPI) findBindingByIDOrNotFound(bindingId string) (*executor.A

Mitigation Strategies

Restrict 'exec' permissions to only fully trusted administrators.
Audit command outputs to verify no sensitive data is written to standard output or standard error.
Monitor application log endpoints for anomalous synchronous API calls.

Remediation Steps:

Upgrade the OliveTin installation to version 3000.17.0 or higher.
Validate the configurations in /etc/OliveTin/config.yaml for data exposure.
Restart the OliveTin service to apply configuration and binary upgrades.

References

Read the full report for CVE-2026-67439 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-67438: CVE-2026-67438: OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in OliveTin

CVE Reports — Fri, 31 Jul 2026 08:30:32 +0000

CVE-2026-67438: OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in OliveTin

Vulnerability ID: CVE-2026-67438
CVSS Score: 6.6
Published: 2026-07-30

An OS command injection vulnerability exists in OliveTin versions >= 3000.2.0 and < 3000.17.0. The flaw stems from a validation bypass in the shell safety engine, which fails to recognize custom regular expression arguments as unsafe for actions run in shell execution mode. Furthermore, because these custom regex checks evaluate partial string matches, attackers can append arbitrary shell metacharacters to valid inputs. This allows unauthenticated or low-privilege users who are authorized to run configured actions to inject shell commands and achieve arbitrary remote code execution on the host system.

TL;DR

OliveTin versions before 3000.17.0 are vulnerable to OS command injection because the shell argument validator excludes 'regex:' argument types from its safety blocklist. Concurrently, unanchored regex validations allow attackers to bypass checks by placing a valid match at the beginning of their input followed by malicious shell commands.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-78 (OS Command Injection)
Attack Vector: Network
CVSS v3.1 Score: 6.6 (Medium)
EPSS Score: 0.00995
Exploit Status: Proof-of-Concept
CISA KEV Status: Not Listed

Affected Systems

OliveTin (Server Deployments)
OliveTin Docker Containers
OliveTin Systemd Services
OliveTin: >= 3000.2.0, < 3000.17.0 (Fixed in: 3000.17.0)

Code Analysis

Commit: 995ff79

Fix command injection via custom regex and add anchor validation patterns.

Mitigation Strategies

Upgrade OliveTin to version 3000.17.0 or later to apply the validation enforcement fixes.
Convert existing shell-mode actions to exec-mode actions inside config.yaml to eliminate the shell parsing vector.
Ensure all custom regular expressions are strictly bounded with start and end anchors (^ and $) if used in other validated contexts.

Remediation Steps:

Review the current OliveTin configuration files (config.yaml) for combinations of 'shell:' and 'type: regex:'.
Replace 'shell:' keys with structured 'exec:' arrays to ensure arguments are handled through secure processes.
Update Docker compose files, Helm charts, or system service binaries to pull OliveTin image/binary version 3000.17.0 or greater.
Restart the OliveTin service and verify configuration logs to ensure no initialization errors occur during loading.

References

Read the full report for CVE-2026-67438 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-63118: CVE-2026-63118: DNS-Rebinding and Cross-Origin Request Execution in Model Context Protocol (MCP) Ruby SDK

CVE Reports — Fri, 31 Jul 2026 07:31:00 +0000

CVE-2026-63118: DNS-Rebinding and Cross-Origin Request Execution in Model Context Protocol (MCP) Ruby SDK

Vulnerability ID: CVE-2026-63118
CVSS Score: 6.9
Published: 2026-07-30

A critical vulnerability (CVE-2026-63118) in the Model Context Protocol (MCP) Ruby SDK allows attackers to execute arbitrary JSON-RPC commands and exfiltrate sensitive local data from an MCP server bound to the local loopback interface. This is achieved through DNS-rebinding and cross-origin request execution due to missing validation of the HTTP Host and Origin headers in the StreamableHTTPTransport component.

TL;DR

A DNS-rebinding flaw in the MCP Ruby SDK (< 0.23.0) allows malicious sites to bypass the browser Same-Origin Policy and run arbitrary local tools.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-346, CWE-350
Attack Vector: Network (AV:N)
CVSS Score: 6.9 (Medium)
Exploit Status: PoC Available
Affected Component: StreamableHTTPTransport
Fixed Version: v0.23.0
CISA KEV Status: Not Listed

Affected Systems

Model Context Protocol (MCP) Ruby SDK (mcp gem)
mcp: < 0.23.0 (Fixed in: v0.23.0)

Code Analysis

Commit: ba54308

Implement DNS rebinding protection in StreamableHTTPTransport by validating Host and Origin headers.

Mitigation Strategies

Upgrade the mcp gem to version 0.23.0 or higher.
Configure upstream Host and Origin validation in reverse proxies.
Restrict server binds strictly to the loopback interface (127.0.0.1 or ::1).

Remediation Steps:

Modify the Gemfile to require 'mcp' version 0.23.0 or higher.
Run 'bundle update mcp' to apply the update.
Optionally define 'allowed_hosts' and 'allowed_origins' parameters if binding to non-loopback interfaces.

References

Read the full report for CVE-2026-63118 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-63119: CVE-2026-63119: Denial of Service via Uncontrolled Resource Consumption in Model Context Protocol Ruby SDK

CVE Reports — Fri, 31 Jul 2026 05:30:32 +0000

CVE-2026-63119: Denial of Service via Uncontrolled Resource Consumption in Model Context Protocol Ruby SDK

Vulnerability ID: CVE-2026-63119
CVSS Score: 6.2
Published: 2026-07-30

CVE-2026-63119 is a high-impact denial-of-service vulnerability in the Model Context Protocol (MCP) Ruby SDK (distributed as the 'mcp' gem) before version 0.23.0. The vulnerability allows an attacker to cause resource exhaustion and process termination by streaming unbounded input to standard I/O streams.

TL;DR

Unbounded standard input stream reading in the Model Context Protocol Ruby SDK allows connected peers or subprocesses to deplete system memory and crash the host application via a continuous stream of data lacking newline separators.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-400 / CWE-770
Attack Vector: Local (AV:L)
CVSS v3.1 Score: 6.2
EPSS Score: 0.00129
Impact Type: Availability (High)
Exploit Status: Proof of Concept Available
KEV Status: Not Listed

Affected Systems

Model Context Protocol (MCP) Ruby SDK prior to version 0.23.0
modelcontextprotocol/ruby-sdk: < 0.23.0 (Fixed in: 0.23.0)

Code Analysis

Commit: 267b8fa

Limit the maximum line bytes read from stdin/stdout to prevent OOM errors

@@ -239,7 +254,7 @@ def read_response(request)...

Commit: 772e0cb

Cap incoming HTTP request bodies at 4 MiB on StreamableHTTPTransport

@@ -71,7 +71,7 @@ def handle_post_request...

Exploit Details

Vulnerability Context: Proof of concept showcasing an unpatched client reading data without newline delimiters from standard output

Mitigation Strategies

Upgrade the 'mcp' Ruby gem to version 0.23.0 or higher
Enforce explicit byte-limit configurations on all standard input/output stream readers
Discard and re-initialize transport objects immediately if a stream handler error is raised

Remediation Steps:

Open the project's Gemfile
Update the 'mcp' gem definition to require version '>= 0.23.0'
Run 'bundle update mcp' to install the patched library version
Restart any running client or server instances utilizing the SDK

References

Read the full report for CVE-2026-63119 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-67430: CVE-2026-67430: Denial of Service via Unbounded Session Retention in Model Context Protocol Ruby SDK

CVE Reports — Fri, 31 Jul 2026 04:31:19 +0000

CVE-2026-67430: Denial of Service via Unbounded Session Retention in Model Context Protocol Ruby SDK

Vulnerability ID: CVE-2026-67430
CVSS Score: 5.3
Published: 2026-07-30

CVE-2026-67430 is a medium-severity Denial of Service (DoS) vulnerability in the Model Context Protocol (MCP) Ruby SDK (packaged as the mcp gem) versions prior to 0.23.0. In stateful deployments using the StreamableHTTPTransport class, client session states are retained in an in-memory hash map. Because the transport implements a nil idle timeout by default, the background scavenger process is suppressed. Remote, unauthenticated attackers can flood the endpoint with initialize requests, rapidly consuming system memory and triggering an Out-of-Memory (OOM) crash.

TL;DR

Unauthenticated remote attackers can crash stateful MCP Ruby SDK servers by repeatedly triggering new initialize requests. Because the SDK lacks default session limits and idle timeouts, every connection allocates a persistent context in RAM, leading to memory exhaustion and service crashes.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-770
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 5.3
EPSS Score: 0.00291
EPSS Percentile: 21.41%
Impact: Denial of Service (DoS) via memory exhaustion (OOM)
Exploit Status: PoC Available
KEV Status: Not Listed

Affected Systems

Model Context Protocol Ruby SDK (mcp gem) running stateful transports
mcp (Ruby SDK): >= 0.6.0, < 0.23.0 (Fixed in: 0.23.0)

Code Analysis

Commit: afb968c

Enforce secure session idle timeouts and concurrent session limits inside StreamableHTTPTransport

Exploit Details

GitHub Security Advisory GHSA-52jp-gj8w-j6xh: Proof of Concept demonstrating creation of 50,000 sessions in 26.6 seconds causing server OOM

Mitigation Strategies

Upgrade the mcp gem to version 0.23.0 or later.
Configure tight session_idle_timeout and max_sessions values on StreamableHTTPTransport initialization.
Utilize stateless: true if stateful session management is not required.
Deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the application to enforce request and connection rate-limiting.

Remediation Steps:

Update your Gemfile to reference mcp version 0.23.0 or later.
Run bundle update mcp to retrieve and apply the security patch.
Optionally, explicitly set session_idle_timeout and max_sessions parameters in your StreamableHTTPTransport.new initializer block.
Restart the Ruby application server to apply the code changes.

References

Read the full report for CVE-2026-67430 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-67432: CVE-2026-67432: High Severity Denial of Service in Model Context Protocol (MCP) Ruby SDK

CVE Reports — Fri, 31 Jul 2026 03:31:26 +0000

CVE-2026-67432: High Severity Denial of Service in Model Context Protocol (MCP) Ruby SDK

Vulnerability ID: CVE-2026-67432
CVSS Score: 7.5
Published: 2026-07-30

An uncontrolled memory allocation vulnerability (CWE-770) exists in the Model Context Protocol (MCP) Ruby SDK (the mcp gem) prior to version 0.23.0. The SDK's StreamableHTTPTransport and StdioTransport layers fail to impose bounds on incoming payloads. An unauthenticated attacker can exploit these issues by transmitting massive, nested payloads to exhaust worker memory, leading to process termination.

TL;DR

The mcp Ruby gem prior to 0.23.0 is vulnerable to unauthenticated, remote denial of service (OOM crash) due to unbounded HTTP body reading, unsafe JSON parsing depth, and unlimited standard input buffering.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-770
Attack Vector: Network
CVSS v3.1 Score: 7.5 (High)
EPSS Score: 0.00436 (35.87%)
Impact: Denial of Service (OOM Crash)
Exploit Status: Proof-of-Concept
CISA KEV Status: Not Listed

Affected Systems

Model Context Protocol Ruby SDK (mcp gem)
mcp: < 0.23.0 (Fixed in: 0.23.0)

Code Analysis

Commit: 772e0cb

Implement bounded payload reads and nesting limits for StreamableHTTPTransport and StdioTransport layers.

Mitigation Strategies

Upgrade the mcp gem to 0.23.0 or higher.
Configure application firewalls to drop payload sizes over a safe limit (e.g. 4MB).
Configure limits programmatically when initializing HTTP and Stdio transports.

Remediation Steps:

In Gemfile, replace existing gem declaration with: gem 'mcp', '>= 0.23.0'
Run 'bundle update mcp' to apply the patch.
Validate application starts successfully and transport initializations are supplied with explicit size configurations if custom thresholds are needed.

References

Read the full report for CVE-2026-67432 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-67431: CVE-2026-67431: Session Poisoning via Improper Access Control in Model Context Protocol Ruby SDK

CVE Reports — Fri, 31 Jul 2026 02:30:31 +0000

CVE-2026-67431: Session Poisoning via Improper Access Control in Model Context Protocol Ruby SDK

Vulnerability ID: CVE-2026-67431
CVSS Score: 8.3
Published: 2026-07-30

An Improper Access Control vulnerability exists in the Model Context Protocol (MCP) Ruby SDK prior to version 0.23.0. The stateful transport implementation failed to bind established sessions to their original owners or connection contexts, enabling unauthorized actors with access to active session IDs to execute arbitrary tools or alter session state.

TL;DR

A lack of session binding in the MCP Ruby SDK allows remote attackers possessing a valid session ID to execute arbitrary tool calls and manipulate session states.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-284
Attack Vector: Network (AV:N)
CVSS v4.0 Score: 8.3
EPSS Score: 0.00276
Exploit Status: POC (in official repository tests)
KEV Status: Not Listed
Impact: High Integrity, Low Availability

Affected Systems

mcp (RubyGems)
Model Context Protocol Ruby SDK
mcp: < 0.23.0 (Fixed in: 0.23.0)

Code Analysis

Commit: 3546660

Implement session validation and HTTP origin checks inside StreamableHTTPTransport

Mitigation Strategies

Upgrade the mcp gem to version 0.23.0 or higher.
Implement the session_request_validator hook to validate incoming requests against active user authentication states.
Limit session idle timeouts and maximum concurrent sessions to reduce exposure.

Remediation Steps:

Identify all deployments using the mcp Ruby gem.
Update the Gemfile to require version 0.23.0 or higher: gem 'mcp', '>= 0.23.0'.
Execute bundle update mcp to install the patched version.
Locate instantiate configurations of MCP::Server::Transports::StreamableHTTPTransport and define a custom session_request_validator callback.
Ensure the callback validates that the user environment (cookies, tokens) matches the active session ownership context.

References

Read the full report for CVE-2026-67431 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-67435: CVE-2026-67435: Custom Authentication Header Leakage via Cross-Origin Redirects in linuxfabrik-lib

CVE Reports — Fri, 31 Jul 2026 01:30:29 +0000

CVE-2026-67435: Custom Authentication Header Leakage via Cross-Origin Redirects in linuxfabrik-lib

Vulnerability ID: CVE-2026-67435
CVSS Score: 6.0
Published: 2026-07-30

CVE-2026-67435 is a security vulnerability in the linuxfabrik-lib Python library prior to version 6.0.0. When performing HTTP requests with follow_redirects enabled, custom authentication headers (such as X-Auth-Token or X-Api-Key) are forwarded during cross-origin redirects. A malicious or compromised server can leverage this behavior to capture sensitive monitoring and administrative credentials, leading to potential unauthorized access and Server-Side Request Forgery (SSRF).

TL;DR

A vulnerability in linuxfabrik-lib prior to 6.0.0 forwards custom authentication headers (such as X-Auth-Token or X-Api-Key) during cross-origin redirects, allowing remote attackers to exfiltrate administrative credentials.

Technical Details

CWE ID: CWE-200, CWE-918
Attack Vector: Network
CVSS v4.0 Score: 6.0
EPSS Score: 0.00286 (Percentile: 20.87%)
Impact: Credential Exposure
Exploit Status: None
KEV Status: Not Listed

Affected Systems

linuxfabrik-lib
Linuxfabrik Monitoring Plugins
linuxfabrik-lib: < 6.0.0 (Fixed in: 6.0.0)

Code Analysis

Commit: 6573ff9

Strip credentials / custom headers on cross-origin redirect

@@ -0,0 +1,41 @@
+_REDIRECT_SAFE_HEADERS = frozenset({
+    'accept',
+    'accept-encoding',
+    'accept-language',
+    'connection',
+    'content-length',
+    'content-type',
+    'host',
+    'transfer-encoding',
+    'user-agent',
+})
+...

Mitigation Strategies

Upgrade linuxfabrik-lib to version 6.0.0 or higher.
Disable redirect handling by passing follow_redirects=False inside client calls.
Restrict network-level egress traffic for monitoring servers to prevent connection handshakes with external untrusted destinations.

Remediation Steps:

Identify all deployment instances of linuxfabrik monitoring scripts within local cronjobs, configuration modules, or service orchestrators.
Update dependencies in requirements.txt or dependency lock files to specify linuxfabrik-lib>=6.0.0.
Deploy the updated library package across all monitoring nodes and verify correct processing of monitoring endpoints.
Apply strict firewall configurations restricting HTTP/HTTPS egress traffic from administrative monitoring subnets to verified destination systems.

References

Read the full report for CVE-2026-67435 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-67429: CVE-2026-67429: Arbitrary File Write and Path Traversal in Flyto2 Core Modules

CVE Reports — Fri, 31 Jul 2026 00:30:31 +0000

CVE-2026-67429: Arbitrary File Write and Path Traversal in Flyto2 Core Modules

Vulnerability ID: CVE-2026-67429
CVSS Score: 10.0
Published: 2026-07-30

CVE-2026-67429 is a critical path traversal vulnerability in Flyto2 Core file-writing modules, including image.download and twelve other modules. By exploiting an insecure validation check that relied on user-controlled parameters, unauthenticated remote attackers can bypass directory confinement and write arbitrary files to the file system, leading to remote code execution.

TL;DR

A critical path traversal vulnerability in Flyto2 Core allows unauthenticated remote code execution via arbitrary file write due to caller-controlled base directory validation parameters.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22, CWE-73
Attack Vector: Network (AV:N)
CVSS Score: 10.0 (Critical)
EPSS Score: 0.00494
Impact: Arbitrary File Write / Remote Code Execution
Exploit Status: Proof of Concept (PoC) verified
KEV Status: Not listed

Affected Systems

Flyto2 Core
flyto-core: < 2.26.6 (Fixed in: 2.26.6)

Code Analysis

Commit: d5f89d7

centralize path validation with sandbox guard

Mitigation Strategies

Upgrade Flyto2 Core to version 2.26.6
Define FLYTO_SANDBOX_DIR to restrict write permissions
Run Flyto2 Core in an unprivileged, read-only container

Remediation Steps:

Identify all active instances of Flyto2 Core in the environment.
Apply the patch by upgrading the PyPI package to version 2.26.6.
Configure the FLYTO_SANDBOX_DIR environment variable to enforce static boundaries.
Audit application logs for suspicious directory overrides in image or document module parameters.

References

Read the full report for CVE-2026-67429 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-67427: CVE-2026-67427: Host Environment Variable Access Policy Bypass via Template Interpolation in Flyto2 Core

CVE Reports — Thu, 30 Jul 2026 23:30:33 +0000

CVE-2026-67427: Host Environment Variable Access Policy Bypass via Template Interpolation in Flyto2 Core

Vulnerability ID: CVE-2026-67427
CVSS Score: 8.6
Published: 2026-07-30

CVE-2026-67427 is a capability bypass vulnerability in the Flyto2 Core workflow execution kernel. Due to a logical inconsistency in how dynamic parameters are resolved, the system evaluates environment variables via template interpolation prior to executing capability filter validation. This permits unprivileged workflow definitions to completely bypass denylist restrictions on the env.get module, exfiltrating critical host configurations, API tokens, and credentials via allowed communication channels.

TL;DR

A logical separation-of-duty flaw in Flyto2 Core's parser allows workflows to bypass security policies. By embedding '${env.VARIABLE}' template strings inside allowed modules, attackers can extract system-level credentials without trigger-blocking module denylists.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-693 (Protection Mechanism Failure)
Attack Vector: Network
CVSS v3.1 Score: 8.6 (High)
EPSS Score: 0.00339 (Percentile: 26.51%)
Impact: Information Disclosure (Host Secret Extraction)
Exploit Status: Proof-of-Concept / Technical Analysis
KEV Status: Not Listed

Affected Systems

Flyto2 Core
flyto-core: < 2.26.6 (Fixed in: 2.26.6)

Code Analysis

Commit: d5f89d7

Secure sandbox directories, credential endpoints, and ${env.*} interpolation.

Exploit Details

GitHub Security Advisory: Technical analysis and remediation directions for the dynamic interpolation bypass.

Mitigation Strategies

Upgrade flyto-core to version 2.26.6 or higher.
Define explicit environment variable boundaries using the newly introduced FLYTO_ENV_VAR_ALLOWLIST variable.
Isolate automation container runtimes and limit the configuration variables exposed to host processes.

Remediation Steps:

Identify all production and test environments running flytohub/flyto-core versions below 2.26.6.
Update project configuration files and build specifications to require version 2.26.6.
Apply the FLYTO_ENV_VAR_ALLOWLIST environment variable in service deployment manifests to restrict dynamic template resolution.
Review historical workflow execution records and audit logs for patterns resembling dynamic variable interpolation calls.

References

Read the full report for CVE-2026-67427 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-67425: CVE-2026-67425: Insecure Credential Forwarding in Flyto2 Core

CVE Reports — Thu, 30 Jul 2026 22:30:35 +0000

CVE-2026-67425: Insecure Credential Forwarding in Flyto2 Core

Vulnerability ID: CVE-2026-67425
CVSS Score: 8.6
Published: 2026-07-30

An insecure credential forwarding vulnerability in Flyto2 Core prior to version 2.26.6 allows attackers to exfiltrate operator API keys. This occurs because the system forwards environment-derived API keys to user-controlled custom endpoints, bypassing SSRF guards designed only for private target validation.

TL;DR

Flyto2 Core incorrectly forwarded high-privilege, environment-derived API keys to caller-controlled endpoints. This allowed unauthenticated remote attackers to exfiltrate sensitive keys by specifying a public, attacker-controlled host as the base URL.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-522, CWE-201
Attack Vector: Network (AV:N)
CVSS v3.1: 8.6 (High)
EPSS Score: 0.00319
Impact: Confidentiality High (C:H)
Exploit Status: Proof-of-Concept / Verified Private
KEV Status: Not Listed

Affected Systems

Flyto2 Core (flytohub/flyto-core)
Flyto2 Core: < 2.26.6 (Fixed in: 2.26.6)

Code Analysis

Commit: d5f89d7

Fix insecure credential forwarding to user-controlled custom endpoints (GHSA-qq9q-xgm3-xv9g)

Exploit Details

GitHub: Proof of concept workflow setup describing extraction of keys using custom base_url triggers.

Mitigation Strategies

Upgrade to Flyto2 Core 2.26.6 or later.
Configure the FLYTO_TRUSTED_LLM_HOSTS environment variable to whitelist permitted custom API gateways.
Establish firewall rules to restrict outbound HTTP/HTTPS traffic to trusted LLM endpoints only.

Remediation Steps:

Pull and deploy the latest version (2.26.6+) of Flyto2 Core.
Audit current configuration files and system environments for exposed API keys.
Define FLYTO_TRUSTED_LLM_HOSTS in your runner environments if you utilize self-hosted or proxy model endpoints.

References

Read the full report for CVE-2026-67425 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2025-4318: CVE-2025-4318: Remote Code Execution in AWS Amplify codegen-ui

CVE Reports — Thu, 30 Jul 2026 21:30:31 +0000

CVE-2025-4318: Remote Code Execution in AWS Amplify codegen-ui

Vulnerability ID: CVE-2025-4318
CVSS Score: 9.0
Published: 2026-07-30

A critical remote code execution (RCE) vulnerability exists in AWS Amplify Studio's code-generation library (@aws-amplify/codegen-ui). An authenticated attacker with permissions to create or modify component schemas can inject malicious JavaScript code into those schemas. When the Amplify CLI or the build environment processes these schemas, the unvalidated expressions are executed within the host Node.js environment, leading to full system compromise.

TL;DR

Remote code execution vulnerability in @aws-amplify/codegen-ui allows authenticated users to execute arbitrary commands during build/generation phases via crafted component schemas.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-95
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: High (Confidentiality, Integrity, Availability)
Exploit Status: PoC available
KEV Status: Not listed

Affected Systems

AWS Amplify Studio UI Builder
@aws-amplify/codegen-ui
@aws-amplify/codegen-ui-react
@aws-amplify/codegen-ui: >= 0.1.0, < 2.20.4 (Fixed in: 2.20.4)
@aws-amplify/codegen-ui-react: >= 0.1.0, < 2.20.4 (Fixed in: 2.20.4)

Code Analysis

Commit: ca98c38

Initial property AST input validation and scripting patterns denylist filter

Commit: 7ce5200

Sanitise bindingEvent and event fields to prevent bypass in UI actions

Exploit Details

SecureLayer7: Detailed write-up of the initial RCE and the event binding bypass.

Mitigation Strategies

Upgrade @aws-amplify/codegen-ui to version 2.20.4 or above
Upgrade @aws-amplify/codegen-ui-react to version 2.20.4 or above
Restrict user permissions in AWS Amplify Studio to trusted personnel
Network-isolate the build pipelines and developer environments to prevent outbound data exfiltration

Remediation Steps:

Run 'npm list @aws-amplify/codegen-ui' to identify the active version.
Execute 'npm install @aws-amplify/codegen-ui@latest @aws-amplify/codegen-ui-react@latest' in all project directories.
Re-generate package lockfiles and commit updates to source control.
Verify global tools with 'npm install -g @aws-amplify/cli@latest'.

References

Read the full report for CVE-2025-4318 on our website for more details including interactive diagrams and full exploit analysis.