{"uuid": "2cf08b77-4424-4ca9-b695-92852fc4af0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67428", "type": "seen", "source": "https://gist.github.com/alon710/abbfb678b2ea15b959183e89124a0f42", "content": "# CVE-2026-67428: CVE-2026-67428: Server-Side Request Forgery in Flyto2 Core HTTP-Emitting Modules\n\n> **CVSS Score:** 8.5\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67428\n\n## Summary\nFlyto2 Core (flyto-core) prior to version 2.26.7 did not utilize its centralized SSRF validation mechanism ('validate_url_with_env_config') across multiple HTTP-emitting modules. This oversight allowed low-privileged users executing automated workflows to perform Server-Side Request Forgery (SSRF) attacks against internal endpoints, loopback interfaces, and cloud provider metadata services.\n\n## TL;DR\nLow-privileged users can execute arbitrary Server-Side Request Forgery (SSRF) attacks against cloud metadata endpoints and local networks due to unvalidated HTTP-emitting modules in Flyto2 Core.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.5 (High)\n- **EPSS Score**: 0.00337 (26.26th percentile)\n- **Impact**: Server-Side Request Forgery / Internal Reconnaissance / Metadata Exfiltration\n- **Exploit Status**: PoC available, no active exploitation reported\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- flyto-core\n- **flyto-core**: < 2.26.7 (Fixed in: `2.26.7`)\n\n## Mitigation\n\n- Upgrade to flyto-core version 2.26.7 or above\n- Enforce container network sandboxing to prevent egress to private host segments\n- Enforce IMDSv2 on cloud compute hosts with an HTTP hop limit of 1\n\n**Remediation Steps:**\n1. Pull the latest Docker image or package release for flyto-core containing tag 2.26.7\n2. Rebuild worker execution instances to apply updated Python source dependencies\n3. Configure egress routing tables inside container hosts to explicitly drop packets aimed at local loopback interfaces and RFC 1918 networks\n4. Audit workflow system execution logs for keywords matching SSRF_BLOCKED to identify blocked malicious behavior\n\n## References\n\n- [GHSA-pgwh-4jj4-qm8v: Decentralized SSRF in Flyto2 Core](https://github.com/flytohub/flyto-core/security/advisories/GHSA-pgwh-4jj4-qm8v)\n- [Flyto2 Core Release v2.26.7](https://github.com/flytohub/flyto-core/releases/tag/v2.26.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67428) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T16:30:59.636678Z"}