https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 13 Aug 2026 17:20:21 +0000 https://vulnerability.circl.lu/sighting/4d2dee30-c092-4a1f-9633-d9fc7f13b3bf/export {"uuid": "4d2dee30-c092-4a1f-9633-d9fc7f13b3bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67422", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3msoxgsu4xc2m", "content": "Another Markdown Hole, Another Marathon Through the Cathedral of Delay\nPANIC 56% | Lag 0.0h | CVE-2026-67422 is a high-severity vulnerability in pymdown-extensions that can expose systems using \n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-08-10T01:34:31.551003Z"} {"uuid": "4d2dee30-c092-4a1f-9633-d9fc7f13b3bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67422", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3msoxgsu4xc2m", "content": "Another Markdown Hole, Another Marathon Through the Cathedral of Delay\nPANIC 56% | Lag 0.0h | CVE-2026-67422 is a high-severity vulnerability in pymdown-extensions that can expose systems using \n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-08-10T01:34:31.551003Z"} https://vulnerability.circl.lu/sighting/4d2dee30-c092-4a1f-9633-d9fc7f13b3bf/export Mon, 10 Aug 2026 01:34:31 +0000 https://vulnerability.circl.lu/sighting/11420815-a22e-4d7d-8aa4-a507ddf5178c/export {"uuid": "11420815-a22e-4d7d-8aa4-a507ddf5178c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67422", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msovkh6vgj24", "content": "\ud83d\udfe0 CVE-2026-67422 - High (7.5)\n\npymdown-extensions is a collection of extensions for the Python Markdown library. In versions up ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67422/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-10T01:00:22.263783Z"} {"uuid": "11420815-a22e-4d7d-8aa4-a507ddf5178c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67422", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msovkh6vgj24", "content": "\ud83d\udfe0 CVE-2026-67422 - High (7.5)\n\npymdown-extensions is a collection of extensions for the Python Markdown library. In versions up ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67422/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-10T01:00:22.263783Z"} https://vulnerability.circl.lu/sighting/11420815-a22e-4d7d-8aa4-a507ddf5178c/export Mon, 10 Aug 2026 01:00:22 +0000 https://vulnerability.circl.lu/sighting/3f992d8b-c0c0-48ea-b23b-552bc0e99fc2/export {"uuid": "3f992d8b-c0c0-48ea-b23b-552bc0e99fc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67422", "type": "seen", "source": "https://gist.github.com/alon710/6f3e0768fc0386f4c965af62333fef78", "content": "# CVE-2026-67422: CVE-2026-67422: Regular Expression Denial of Service in pymdown-extensions\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67422\n\n## Summary\nA high-severity Regular Expression Denial of Service (ReDoS) vulnerability in pymdown-extensions versions prior to 11.0.1 affects the Caret, Tilde, BetterEm, and MagicLink inline processors. When parsing user-supplied Markdown content containing malicious sequences of formatting delimiters, the regular expression engine is forced into catastrophic backtracking, resulting in CPU exhaustion and application denial of service.\n\n## TL;DR\nInefficient regular expressions in multiple inline processors of pymdown-extensions allow unauthenticated attackers to cause complete CPU exhaustion and Denial of Service with short, crafted Markdown payloads of fewer than 50 bytes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1333\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00582 (Percentile: 44.59%)\n- **Impact**: Denial of Service (CPU Exhaustion)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications rendering Markdown using Python Markdown with the pymdown-extensions library.\n- Static site generators and documentation build pipelines utilizing the BetterEm, Caret, Tilde, or MagicLink extensions.\n- **pymdown-extensions**: < 11.0.1 (Fixed in: `11.0.1`)\n\n## Mitigation\n\n- Upgrade pymdown-extensions to version 11.0.1 or higher.\n- Implement maximum character limits on untrusted Markdown inputs at the application layer.\n- Configure WAF rules to detect and block abnormally long sequences of formatting delimiters.\n\n**Remediation Steps:**\n1. Identify all environments containing the pymdown-extensions package.\n2. Update the dependency using your package manager, for example: pip install --upgrade pymdown-extensions>=11.0.1.\n3. Verify the installed version is 11.0.1 or higher using pip show pymdown-extensions.\n4. Deploy the updated application to production and monitor CPU usage patterns.\n\n## References\n\n- [GitHub Security Advisory GHSA-gm37-52c6-37mw](https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw)\n- [Patch Commit c684985](https://github.com/facelessuser/pymdown-extensions/commit/c68498598d7b13011bb4571350b6e3612a4ce44b)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67422) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T02:32:35.100867Z"} {"uuid": "3f992d8b-c0c0-48ea-b23b-552bc0e99fc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67422", "type": "seen", "source": "https://gist.github.com/alon710/6f3e0768fc0386f4c965af62333fef78", "content": "# CVE-2026-67422: CVE-2026-67422: Regular Expression Denial of Service in pymdown-extensions\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67422\n\n## Summary\nA high-severity Regular Expression Denial of Service (ReDoS) vulnerability in pymdown-extensions versions prior to 11.0.1 affects the Caret, Tilde, BetterEm, and MagicLink inline processors. When parsing user-supplied Markdown content containing malicious sequences of formatting delimiters, the regular expression engine is forced into catastrophic backtracking, resulting in CPU exhaustion and application denial of service.\n\n## TL;DR\nInefficient regular expressions in multiple inline processors of pymdown-extensions allow unauthenticated attackers to cause complete CPU exhaustion and Denial of Service with short, crafted Markdown payloads of fewer than 50 bytes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1333\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00582 (Percentile: 44.59%)\n- **Impact**: Denial of Service (CPU Exhaustion)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications rendering Markdown using Python Markdown with the pymdown-extensions library.\n- Static site generators and documentation build pipelines utilizing the BetterEm, Caret, Tilde, or MagicLink extensions.\n- **pymdown-extensions**: < 11.0.1 (Fixed in: `11.0.1`)\n\n## Mitigation\n\n- Upgrade pymdown-extensions to version 11.0.1 or higher.\n- Implement maximum character limits on untrusted Markdown inputs at the application layer.\n- Configure WAF rules to detect and block abnormally long sequences of formatting delimiters.\n\n**Remediation Steps:**\n1. Identify all environments containing the pymdown-extensions package.\n2. Update the dependency using your package manager, for example: pip install --upgrade pymdown-extensions>=11.0.1.\n3. Verify the installed version is 11.0.1 or higher using pip show pymdown-extensions.\n4. Deploy the updated application to production and monitor CPU usage patterns.\n\n## References\n\n- [GitHub Security Advisory GHSA-gm37-52c6-37mw](https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw)\n- [Patch Commit c684985](https://github.com/facelessuser/pymdown-extensions/commit/c68498598d7b13011bb4571350b6e3612a4ce44b)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67422) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T02:32:35.100867Z"} https://vulnerability.circl.lu/sighting/3f992d8b-c0c0-48ea-b23b-552bc0e99fc2/export Sat, 08 Aug 2026 02:32:35 +0000 https://vulnerability.circl.lu/sighting/27fae5c1-76ce-4b05-a95f-0a19b09be092/export {"uuid": "27fae5c1-76ce-4b05-a95f-0a19b09be092", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67422", "type": "published-proof-of-concept", "source": "https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw", "content": "", "creation_timestamp": "2026-08-07T21:05:02.574875Z"} {"uuid": "27fae5c1-76ce-4b05-a95f-0a19b09be092", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67422", "type": "published-proof-of-concept", "source": "https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw", "content": "", "creation_timestamp": "2026-08-07T21:05:02.574875Z"} https://vulnerability.circl.lu/sighting/27fae5c1-76ce-4b05-a95f-0a19b09be092/export Fri, 07 Aug 2026 21:05:02 +0000 https://vulnerability.circl.lu/sighting/2775eb8f-bb88-4e5a-82a8-4af1b4bdd7cf/export {"uuid": "2775eb8f-bb88-4e5a-82a8-4af1b4bdd7cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67429", "type": "seen", "source": "https://gist.github.com/alon710/3970c6098c97c0a550d8b2c18182c3ad", "content": "# CVE-2026-67429: CVE-2026-67429: Arbitrary File Write and Path Traversal in Flyto2 Core Modules\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67429\n\n## Summary\nCVE-2026-67429 is a critical path traversal vulnerability in Flyto2 Core file-writing modules, including image.download and twelve other modules. By exploiting an insecure validation check that relied on user-controlled parameters, unauthenticated remote attackers can bypass directory confinement and write arbitrary files to the file system, leading to remote code execution.\n\n## TL;DR\nA critical path traversal vulnerability in Flyto2 Core allows unauthenticated remote code execution via arbitrary file write due to caller-controlled base directory validation parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-73\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 10.0 (Critical)\n- **EPSS Score**: 0.00494\n- **Impact**: Arbitrary File Write / Remote Code Execution\n- **Exploit Status**: Proof of Concept (PoC) verified\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Flyto2 Core\n- **flyto-core**: < 2.26.6 (Fixed in: `2.26.6`)\n\n## Mitigation\n\n- Upgrade Flyto2 Core to version 2.26.6\n- Define FLYTO_SANDBOX_DIR to restrict write permissions\n- Run Flyto2 Core in an unprivileged, read-only container\n\n**Remediation Steps:**\n1. Identify all active instances of Flyto2 Core in the environment.\n2. Apply the patch by upgrading the PyPI package to version 2.26.6.\n3. Configure the FLYTO_SANDBOX_DIR environment variable to enforce static boundaries.\n4. Audit application logs for suspicious directory overrides in image or document module parameters.\n\n## References\n\n- [GitHub Security Advisory GHSA-2956-977x-2w3r](https://github.com/flytohub/flyto-core/security/advisories/GHSA-2956-977x-2w3r)\n- [Fix Commit d5f89d71303e](https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc)\n- [Release Notes v2.26.6](https://github.com/flytohub/flyto-core/releases/tag/v2.26.6)\n- [CVE-2026-67429 Record](https://www.cve.org/CVERecord?id=CVE-2026-67429)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67429) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T00:31:48.917307Z"} {"uuid": "2775eb8f-bb88-4e5a-82a8-4af1b4bdd7cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67429", "type": "seen", "source": "https://gist.github.com/alon710/3970c6098c97c0a550d8b2c18182c3ad", "content": "# CVE-2026-67429: CVE-2026-67429: Arbitrary File Write and Path Traversal in Flyto2 Core Modules\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67429\n\n## Summary\nCVE-2026-67429 is a critical path traversal vulnerability in Flyto2 Core file-writing modules, including image.download and twelve other modules. By exploiting an insecure validation check that relied on user-controlled parameters, unauthenticated remote attackers can bypass directory confinement and write arbitrary files to the file system, leading to remote code execution.\n\n## TL;DR\nA critical path traversal vulnerability in Flyto2 Core allows unauthenticated remote code execution via arbitrary file write due to caller-controlled base directory validation parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-73\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 10.0 (Critical)\n- **EPSS Score**: 0.00494\n- **Impact**: Arbitrary File Write / Remote Code Execution\n- **Exploit Status**: Proof of Concept (PoC) verified\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Flyto2 Core\n- **flyto-core**: < 2.26.6 (Fixed in: `2.26.6`)\n\n## Mitigation\n\n- Upgrade Flyto2 Core to version 2.26.6\n- Define FLYTO_SANDBOX_DIR to restrict write permissions\n- Run Flyto2 Core in an unprivileged, read-only container\n\n**Remediation Steps:**\n1. Identify all active instances of Flyto2 Core in the environment.\n2. Apply the patch by upgrading the PyPI package to version 2.26.6.\n3. Configure the FLYTO_SANDBOX_DIR environment variable to enforce static boundaries.\n4. Audit application logs for suspicious directory overrides in image or document module parameters.\n\n## References\n\n- [GitHub Security Advisory GHSA-2956-977x-2w3r](https://github.com/flytohub/flyto-core/security/advisories/GHSA-2956-977x-2w3r)\n- [Fix Commit d5f89d71303e](https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc)\n- [Release Notes v2.26.6](https://github.com/flytohub/flyto-core/releases/tag/v2.26.6)\n- [CVE-2026-67429 Record](https://www.cve.org/CVERecord?id=CVE-2026-67429)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67429) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T00:31:48.917307Z"} https://vulnerability.circl.lu/sighting/2775eb8f-bb88-4e5a-82a8-4af1b4bdd7cf/export Fri, 31 Jul 2026 00:31:48 +0000 https://vulnerability.circl.lu/sighting/f4d766f2-ea46-4df5-a30a-06e046ade408/export {"uuid": "f4d766f2-ea46-4df5-a30a-06e046ade408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67425", "type": "seen", "source": "https://gist.github.com/alon710/118a4cdb35451ca1b82ac84f2659aa47", "content": "# CVE-2026-67425: CVE-2026-67425: Insecure Credential Forwarding in Flyto2 Core\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67425\n\n## Summary\nAn insecure credential forwarding vulnerability in Flyto2 Core prior to version 2.26.6 allows attackers to exfiltrate operator API keys. This occurs because the system forwards environment-derived API keys to user-controlled custom endpoints, bypassing SSRF guards designed only for private target validation.\n\n## TL;DR\nFlyto2 Core incorrectly forwarded high-privilege, environment-derived API keys to caller-controlled endpoints. This allowed unauthenticated remote attackers to exfiltrate sensitive keys by specifying a public, attacker-controlled host as the base URL.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-522, CWE-201\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 8.6 (High)\n- **EPSS Score**: 0.00319\n- **Impact**: Confidentiality High (C:H)\n- **Exploit Status**: Proof-of-Concept / Verified Private\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Flyto2 Core (flytohub/flyto-core)\n- **Flyto2 Core**: < 2.26.6 (Fixed in: `2.26.6`)\n\n## Mitigation\n\n- Upgrade to Flyto2 Core 2.26.6 or later.\n- Configure the FLYTO_TRUSTED_LLM_HOSTS environment variable to whitelist permitted custom API gateways.\n- Establish firewall rules to restrict outbound HTTP/HTTPS traffic to trusted LLM endpoints only.\n\n**Remediation Steps:**\n1. Pull and deploy the latest version (2.26.6+) of Flyto2 Core.\n2. Audit current configuration files and system environments for exposed API keys.\n3. Define FLYTO_TRUSTED_LLM_HOSTS in your runner environments if you utilize self-hosted or proxy model endpoints.\n\n## References\n\n- [Insecure Credential Forwarding in Flyto2 Core](https://github.com/flytohub/flyto-core/security/advisories/GHSA-qq9q-xgm3-xv9g)\n- [Fix Insecure Credential Forwarding Commit](https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc)\n- [Flyto2 Core Release Tag v2.26.6](https://github.com/flytohub/flyto-core/releases/tag/v2.26.6)\n- [NVD - CVE-2026-67425](https://nvd.nist.gov/vuln/detail/CVE-2026-67425)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67425) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T00:01:11.875348Z"} {"uuid": "f4d766f2-ea46-4df5-a30a-06e046ade408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67425", "type": "seen", "source": "https://gist.github.com/alon710/118a4cdb35451ca1b82ac84f2659aa47", "content": "# CVE-2026-67425: CVE-2026-67425: Insecure Credential Forwarding in Flyto2 Core\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67425\n\n## Summary\nAn insecure credential forwarding vulnerability in Flyto2 Core prior to version 2.26.6 allows attackers to exfiltrate operator API keys. This occurs because the system forwards environment-derived API keys to user-controlled custom endpoints, bypassing SSRF guards designed only for private target validation.\n\n## TL;DR\nFlyto2 Core incorrectly forwarded high-privilege, environment-derived API keys to caller-controlled endpoints. This allowed unauthenticated remote attackers to exfiltrate sensitive keys by specifying a public, attacker-controlled host as the base URL.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-522, CWE-201\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 8.6 (High)\n- **EPSS Score**: 0.00319\n- **Impact**: Confidentiality High (C:H)\n- **Exploit Status**: Proof-of-Concept / Verified Private\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Flyto2 Core (flytohub/flyto-core)\n- **Flyto2 Core**: < 2.26.6 (Fixed in: `2.26.6`)\n\n## Mitigation\n\n- Upgrade to Flyto2 Core 2.26.6 or later.\n- Configure the FLYTO_TRUSTED_LLM_HOSTS environment variable to whitelist permitted custom API gateways.\n- Establish firewall rules to restrict outbound HTTP/HTTPS traffic to trusted LLM endpoints only.\n\n**Remediation Steps:**\n1. Pull and deploy the latest version (2.26.6+) of Flyto2 Core.\n2. Audit current configuration files and system environments for exposed API keys.\n3. Define FLYTO_TRUSTED_LLM_HOSTS in your runner environments if you utilize self-hosted or proxy model endpoints.\n\n## References\n\n- [Insecure Credential Forwarding in Flyto2 Core](https://github.com/flytohub/flyto-core/security/advisories/GHSA-qq9q-xgm3-xv9g)\n- [Fix Insecure Credential Forwarding Commit](https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc)\n- [Flyto2 Core Release Tag v2.26.6](https://github.com/flytohub/flyto-core/releases/tag/v2.26.6)\n- [NVD - CVE-2026-67425](https://nvd.nist.gov/vuln/detail/CVE-2026-67425)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67425) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T00:01:11.875348Z"} https://vulnerability.circl.lu/sighting/f4d766f2-ea46-4df5-a30a-06e046ade408/export Fri, 31 Jul 2026 00:01:11 +0000 https://vulnerability.circl.lu/sighting/ee835e43-d448-4cd3-af5b-f2f7b97f1f53/export {"uuid": "ee835e43-d448-4cd3-af5b-f2f7b97f1f53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67427", "type": "seen", "source": "https://gist.github.com/alon710/937397e52a8e0970b2abb603a8f2aff3", "content": "# CVE-2026-67427: CVE-2026-67427: Host Environment Variable Access Policy Bypass via Template Interpolation in Flyto2 Core\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67427\n\n## Summary\nCVE-2026-67427 is a capability bypass vulnerability in the Flyto2 Core workflow execution kernel. Due to a logical inconsistency in how dynamic parameters are resolved, the system evaluates environment variables via template interpolation prior to executing capability filter validation. This permits unprivileged workflow definitions to completely bypass denylist restrictions on the `env.get` module, exfiltrating critical host configurations, API tokens, and credentials via allowed communication channels.\n\n## TL;DR\nA logical separation-of-duty flaw in Flyto2 Core's parser allows workflows to bypass security policies. By embedding '${env.VARIABLE}' template strings inside allowed modules, attackers can extract system-level credentials without trigger-blocking module denylists.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-693 (Protection Mechanism Failure)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.6 (High)\n- **EPSS Score**: 0.00339 (Percentile: 26.51%)\n- **Impact**: Information Disclosure (Host Secret Extraction)\n- **Exploit Status**: Proof-of-Concept / Technical Analysis\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Flyto2 Core\n- **flyto-core**: < 2.26.6 (Fixed in: `2.26.6`)\n\n## Mitigation\n\n- Upgrade flyto-core to version 2.26.6 or higher.\n- Define explicit environment variable boundaries using the newly introduced FLYTO_ENV_VAR_ALLOWLIST variable.\n- Isolate automation container runtimes and limit the configuration variables exposed to host processes.\n\n**Remediation Steps:**\n1. Identify all production and test environments running flytohub/flyto-core versions below 2.26.6.\n2. Update project configuration files and build specifications to require version 2.26.6.\n3. Apply the FLYTO_ENV_VAR_ALLOWLIST environment variable in service deployment manifests to restrict dynamic template resolution.\n4. Review historical workflow execution records and audit logs for patterns resembling dynamic variable interpolation calls.\n\n## References\n\n- [GitHub Security Advisory GHSA-hr7p-wg7r-hg9m](https://github.com/flytohub/flyto-core/security/advisories/GHSA-hr7p-wg7r-hg9m)\n- [Fix Commit d5f89d7](https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc)\n- [Flyto Core v2.26.6 Release Notes](https://github.com/flytohub/flyto-core/releases/tag/v2.26.6)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-67427)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67427) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T00:01:11.752089Z"} {"uuid": "ee835e43-d448-4cd3-af5b-f2f7b97f1f53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67427", "type": "seen", "source": "https://gist.github.com/alon710/937397e52a8e0970b2abb603a8f2aff3", "content": "# CVE-2026-67427: CVE-2026-67427: Host Environment Variable Access Policy Bypass via Template Interpolation in Flyto2 Core\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67427\n\n## Summary\nCVE-2026-67427 is a capability bypass vulnerability in the Flyto2 Core workflow execution kernel. Due to a logical inconsistency in how dynamic parameters are resolved, the system evaluates environment variables via template interpolation prior to executing capability filter validation. This permits unprivileged workflow definitions to completely bypass denylist restrictions on the `env.get` module, exfiltrating critical host configurations, API tokens, and credentials via allowed communication channels.\n\n## TL;DR\nA logical separation-of-duty flaw in Flyto2 Core's parser allows workflows to bypass security policies. By embedding '${env.VARIABLE}' template strings inside allowed modules, attackers can extract system-level credentials without trigger-blocking module denylists.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-693 (Protection Mechanism Failure)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.6 (High)\n- **EPSS Score**: 0.00339 (Percentile: 26.51%)\n- **Impact**: Information Disclosure (Host Secret Extraction)\n- **Exploit Status**: Proof-of-Concept / Technical Analysis\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Flyto2 Core\n- **flyto-core**: < 2.26.6 (Fixed in: `2.26.6`)\n\n## Mitigation\n\n- Upgrade flyto-core to version 2.26.6 or higher.\n- Define explicit environment variable boundaries using the newly introduced FLYTO_ENV_VAR_ALLOWLIST variable.\n- Isolate automation container runtimes and limit the configuration variables exposed to host processes.\n\n**Remediation Steps:**\n1. Identify all production and test environments running flytohub/flyto-core versions below 2.26.6.\n2. Update project configuration files and build specifications to require version 2.26.6.\n3. Apply the FLYTO_ENV_VAR_ALLOWLIST environment variable in service deployment manifests to restrict dynamic template resolution.\n4. Review historical workflow execution records and audit logs for patterns resembling dynamic variable interpolation calls.\n\n## References\n\n- [GitHub Security Advisory GHSA-hr7p-wg7r-hg9m](https://github.com/flytohub/flyto-core/security/advisories/GHSA-hr7p-wg7r-hg9m)\n- [Fix Commit d5f89d7](https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc)\n- [Flyto Core v2.26.6 Release Notes](https://github.com/flytohub/flyto-core/releases/tag/v2.26.6)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-67427)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67427) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T00:01:11.752089Z"} https://vulnerability.circl.lu/sighting/ee835e43-d448-4cd3-af5b-f2f7b97f1f53/export Fri, 31 Jul 2026 00:01:11 +0000 https://vulnerability.circl.lu/sighting/cd44b5af-8db2-4165-a37d-65117227153a/export {"uuid": "cd44b5af-8db2-4165-a37d-65117227153a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67427", "type": "seen", "source": "https://gist.github.com/alon710/937397e52a8e0970b2abb603a8f2aff3", "content": "# CVE-2026-67427: CVE-2026-67427: Host Environment Variable Access Policy Bypass via Template Interpolation in Flyto2 Core\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67427\n\n## Summary\nCVE-2026-67427 is a capability bypass vulnerability in the Flyto2 Core workflow execution kernel. Due to a logical inconsistency in how dynamic parameters are resolved, the system evaluates environment variables via template interpolation prior to executing capability filter validation. This permits unprivileged workflow definitions to completely bypass denylist restrictions on the `env.get` module, exfiltrating critical host configurations, API tokens, and credentials via allowed communication channels.\n\n## TL;DR\nA logical separation-of-duty flaw in Flyto2 Core's parser allows workflows to bypass security policies. By embedding '${env.VARIABLE}' template strings inside allowed modules, attackers can extract system-level credentials without trigger-blocking module denylists.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-693 (Protection Mechanism Failure)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.6 (High)\n- **EPSS Score**: 0.00339 (Percentile: 26.51%)\n- **Impact**: Information Disclosure (Host Secret Extraction)\n- **Exploit Status**: Proof-of-Concept / Technical Analysis\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Flyto2 Core\n- **flyto-core**: < 2.26.6 (Fixed in: `2.26.6`)\n\n## Mitigation\n\n- Upgrade flyto-core to version 2.26.6 or higher.\n- Define explicit environment variable boundaries using the newly introduced FLYTO_ENV_VAR_ALLOWLIST variable.\n- Isolate automation container runtimes and limit the configuration variables exposed to host processes.\n\n**Remediation Steps:**\n1. Identify all production and test environments running flytohub/flyto-core versions below 2.26.6.\n2. Update project configuration files and build specifications to require version 2.26.6.\n3. Apply the FLYTO_ENV_VAR_ALLOWLIST environment variable in service deployment manifests to restrict dynamic template resolution.\n4. Review historical workflow execution records and audit logs for patterns resembling dynamic variable interpolation calls.\n\n## References\n\n- [GitHub Security Advisory GHSA-hr7p-wg7r-hg9m](https://github.com/flytohub/flyto-core/security/advisories/GHSA-hr7p-wg7r-hg9m)\n- [Fix Commit d5f89d7](https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc)\n- [Flyto Core v2.26.6 Release Notes](https://github.com/flytohub/flyto-core/releases/tag/v2.26.6)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-67427)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67427) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T23:32:08.881211Z"} {"uuid": "cd44b5af-8db2-4165-a37d-65117227153a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67427", "type": "seen", "source": "https://gist.github.com/alon710/937397e52a8e0970b2abb603a8f2aff3", "content": "# CVE-2026-67427: CVE-2026-67427: Host Environment Variable Access Policy Bypass via Template Interpolation in Flyto2 Core\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67427\n\n## Summary\nCVE-2026-67427 is a capability bypass vulnerability in the Flyto2 Core workflow execution kernel. Due to a logical inconsistency in how dynamic parameters are resolved, the system evaluates environment variables via template interpolation prior to executing capability filter validation. This permits unprivileged workflow definitions to completely bypass denylist restrictions on the `env.get` module, exfiltrating critical host configurations, API tokens, and credentials via allowed communication channels.\n\n## TL;DR\nA logical separation-of-duty flaw in Flyto2 Core's parser allows workflows to bypass security policies. By embedding '${env.VARIABLE}' template strings inside allowed modules, attackers can extract system-level credentials without trigger-blocking module denylists.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-693 (Protection Mechanism Failure)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.6 (High)\n- **EPSS Score**: 0.00339 (Percentile: 26.51%)\n- **Impact**: Information Disclosure (Host Secret Extraction)\n- **Exploit Status**: Proof-of-Concept / Technical Analysis\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Flyto2 Core\n- **flyto-core**: < 2.26.6 (Fixed in: `2.26.6`)\n\n## Mitigation\n\n- Upgrade flyto-core to version 2.26.6 or higher.\n- Define explicit environment variable boundaries using the newly introduced FLYTO_ENV_VAR_ALLOWLIST variable.\n- Isolate automation container runtimes and limit the configuration variables exposed to host processes.\n\n**Remediation Steps:**\n1. Identify all production and test environments running flytohub/flyto-core versions below 2.26.6.\n2. Update project configuration files and build specifications to require version 2.26.6.\n3. Apply the FLYTO_ENV_VAR_ALLOWLIST environment variable in service deployment manifests to restrict dynamic template resolution.\n4. Review historical workflow execution records and audit logs for patterns resembling dynamic variable interpolation calls.\n\n## References\n\n- [GitHub Security Advisory GHSA-hr7p-wg7r-hg9m](https://github.com/flytohub/flyto-core/security/advisories/GHSA-hr7p-wg7r-hg9m)\n- [Fix Commit d5f89d7](https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc)\n- [Flyto Core v2.26.6 Release Notes](https://github.com/flytohub/flyto-core/releases/tag/v2.26.6)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-67427)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67427) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T23:32:08.881211Z"} https://vulnerability.circl.lu/sighting/cd44b5af-8db2-4165-a37d-65117227153a/export Thu, 30 Jul 2026 23:32:08 +0000 https://vulnerability.circl.lu/sighting/0d8c705b-ba80-4b03-b7af-c696602f7076/export {"uuid": "0d8c705b-ba80-4b03-b7af-c696602f7076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67425", "type": "seen", "source": "https://gist.github.com/alon710/118a4cdb35451ca1b82ac84f2659aa47", "content": "# CVE-2026-67425: CVE-2026-67425: Insecure Credential Forwarding in Flyto2 Core\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67425\n\n## Summary\nAn insecure credential forwarding vulnerability in Flyto2 Core prior to version 2.26.6 allows attackers to exfiltrate operator API keys. This occurs because the system forwards environment-derived API keys to user-controlled custom endpoints, bypassing SSRF guards designed only for private target validation.\n\n## TL;DR\nFlyto2 Core incorrectly forwarded high-privilege, environment-derived API keys to caller-controlled endpoints. This allowed unauthenticated remote attackers to exfiltrate sensitive keys by specifying a public, attacker-controlled host as the base URL.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-522, CWE-201\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 8.6 (High)\n- **EPSS Score**: 0.00319\n- **Impact**: Confidentiality High (C:H)\n- **Exploit Status**: Proof-of-Concept / Verified Private\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Flyto2 Core (flytohub/flyto-core)\n- **Flyto2 Core**: < 2.26.6 (Fixed in: `2.26.6`)\n\n## Mitigation\n\n- Upgrade to Flyto2 Core 2.26.6 or later.\n- Configure the FLYTO_TRUSTED_LLM_HOSTS environment variable to whitelist permitted custom API gateways.\n- Establish firewall rules to restrict outbound HTTP/HTTPS traffic to trusted LLM endpoints only.\n\n**Remediation Steps:**\n1. Pull and deploy the latest version (2.26.6+) of Flyto2 Core.\n2. Audit current configuration files and system environments for exposed API keys.\n3. Define FLYTO_TRUSTED_LLM_HOSTS in your runner environments if you utilize self-hosted or proxy model endpoints.\n\n## References\n\n- [Insecure Credential Forwarding in Flyto2 Core](https://github.com/flytohub/flyto-core/security/advisories/GHSA-qq9q-xgm3-xv9g)\n- [Fix Insecure Credential Forwarding Commit](https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc)\n- [Flyto2 Core Release Tag v2.26.6](https://github.com/flytohub/flyto-core/releases/tag/v2.26.6)\n- [NVD - CVE-2026-67425](https://nvd.nist.gov/vuln/detail/CVE-2026-67425)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67425) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T22:32:21.523271Z"} {"uuid": "0d8c705b-ba80-4b03-b7af-c696602f7076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67425", "type": "seen", "source": "https://gist.github.com/alon710/118a4cdb35451ca1b82ac84f2659aa47", "content": "# CVE-2026-67425: CVE-2026-67425: Insecure Credential Forwarding in Flyto2 Core\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67425\n\n## Summary\nAn insecure credential forwarding vulnerability in Flyto2 Core prior to version 2.26.6 allows attackers to exfiltrate operator API keys. This occurs because the system forwards environment-derived API keys to user-controlled custom endpoints, bypassing SSRF guards designed only for private target validation.\n\n## TL;DR\nFlyto2 Core incorrectly forwarded high-privilege, environment-derived API keys to caller-controlled endpoints. This allowed unauthenticated remote attackers to exfiltrate sensitive keys by specifying a public, attacker-controlled host as the base URL.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-522, CWE-201\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 8.6 (High)\n- **EPSS Score**: 0.00319\n- **Impact**: Confidentiality High (C:H)\n- **Exploit Status**: Proof-of-Concept / Verified Private\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Flyto2 Core (flytohub/flyto-core)\n- **Flyto2 Core**: < 2.26.6 (Fixed in: `2.26.6`)\n\n## Mitigation\n\n- Upgrade to Flyto2 Core 2.26.6 or later.\n- Configure the FLYTO_TRUSTED_LLM_HOSTS environment variable to whitelist permitted custom API gateways.\n- Establish firewall rules to restrict outbound HTTP/HTTPS traffic to trusted LLM endpoints only.\n\n**Remediation Steps:**\n1. Pull and deploy the latest version (2.26.6+) of Flyto2 Core.\n2. Audit current configuration files and system environments for exposed API keys.\n3. Define FLYTO_TRUSTED_LLM_HOSTS in your runner environments if you utilize self-hosted or proxy model endpoints.\n\n## References\n\n- [Insecure Credential Forwarding in Flyto2 Core](https://github.com/flytohub/flyto-core/security/advisories/GHSA-qq9q-xgm3-xv9g)\n- [Fix Insecure Credential Forwarding Commit](https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc)\n- [Flyto2 Core Release Tag v2.26.6](https://github.com/flytohub/flyto-core/releases/tag/v2.26.6)\n- [NVD - CVE-2026-67425](https://nvd.nist.gov/vuln/detail/CVE-2026-67425)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67425) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T22:32:21.523271Z"} https://vulnerability.circl.lu/sighting/0d8c705b-ba80-4b03-b7af-c696602f7076/export Thu, 30 Jul 2026 22:32:21 +0000 https://vulnerability.circl.lu/sighting/ca6ab918-4af3-4511-b4ac-6e848c0635a2/export {"uuid": "ca6ab918-4af3-4511-b4ac-6e848c0635a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67426", "type": "seen", "source": "https://gist.github.com/alon710/c5ece1b4b71f33d4bb332d0422fd7596", "content": "# CVE-2026-67426: CVE-2026-67426: Unauthenticated Remote Code Execution and Secret Exfiltration in Flyto2 Core\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67426\n\n## Summary\nCVE-2026-67426 is a critical vulnerability in Flyto2 Core prior to version 2.26.7. The standalone flyto-verification service binds to all interfaces (0.0.0.0) on port 8344 and exposes an unauthenticated POST /run endpoint. This endpoint accepts an arbitrary client-controlled callback URL and makes an outbound POST request containing the sensitive internal runner secret in the headers. Attackers can exploit this to retrieve the FLYTO_RUNNER_SECRET and perform Server-Side Request Forgery (SSRF) against internal network targets.\n\n## TL;DR\nThe flyto-verification service exposed an unauthenticated endpoint that sent internal runner secrets to arbitrary callback URLs, facilitating credential exfiltration and SSRF.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-918, CWE-522\n- **Attack Vector**: Network\n- **CVSS Base Score**: 9.3\n- **EPSS Score**: 0.00291 (0.29%)\n- **Exploit Status**: poc\n- **KEV Status**: not listed\n- **Affected Component**: flyto-verification service (port 8344)\n\n## Affected Systems\n\n- Flyto2 Core\n- **flyto-core**: < 2.26.7 (Fixed in: `2.26.7`)\n\n## Mitigation\n\n- Update flyto-core to version 2.26.7 or newer.\n- Bind port 8344 exclusively to local network interfaces or trusted internal container subnets.\n- Configure the FLYTO_VERIFICATION_API_KEY environment variable to enable token comparison checks.\n- Use FLYTO_TRUSTED_CALLBACK_HOSTS to limit authorized callback endpoints.\n\n**Remediation Steps:**\n1. Identify all deployment instances running flyto-core versions prior to v2.26.7.\n2. Modify deployment configuration files or docker-compose files to pull flyto-core:2.26.7 or higher.\n3. Inject environment variable FLYTO_VERIFICATION_API_KEY with a secure, randomly generated alphanumeric string.\n4. Configure the FLYTO_ENGINE_URL and FLYTO_TRUSTED_CALLBACK_HOSTS environment variables to reflect trusted services.\n5. Deploy network security groups or local firewall rules (iptables/ufw) to drop external traffic attempting to connect to TCP port 8344.\n6. Restart the flyto-verification containers to apply the patched binary and environment configurations.\n\n## References\n\n- [National Vulnerability Database record for CVE-2026-67426](https://nvd.nist.gov/vuln/detail/CVE-2026-67426)\n- [CVE Program Record for CVE-2026-67426](https://www.cve.org/CVERecord?id=CVE-2026-67426)\n- [GitHub Security Advisory (GHSA-jx74-cqjv-2c67)](https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67426) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T20:33:08.589232Z"} {"uuid": "ca6ab918-4af3-4511-b4ac-6e848c0635a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67426", "type": "seen", "source": "https://gist.github.com/alon710/c5ece1b4b71f33d4bb332d0422fd7596", "content": "# CVE-2026-67426: CVE-2026-67426: Unauthenticated Remote Code Execution and Secret Exfiltration in Flyto2 Core\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67426\n\n## Summary\nCVE-2026-67426 is a critical vulnerability in Flyto2 Core prior to version 2.26.7. The standalone flyto-verification service binds to all interfaces (0.0.0.0) on port 8344 and exposes an unauthenticated POST /run endpoint. This endpoint accepts an arbitrary client-controlled callback URL and makes an outbound POST request containing the sensitive internal runner secret in the headers. Attackers can exploit this to retrieve the FLYTO_RUNNER_SECRET and perform Server-Side Request Forgery (SSRF) against internal network targets.\n\n## TL;DR\nThe flyto-verification service exposed an unauthenticated endpoint that sent internal runner secrets to arbitrary callback URLs, facilitating credential exfiltration and SSRF.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-918, CWE-522\n- **Attack Vector**: Network\n- **CVSS Base Score**: 9.3\n- **EPSS Score**: 0.00291 (0.29%)\n- **Exploit Status**: poc\n- **KEV Status**: not listed\n- **Affected Component**: flyto-verification service (port 8344)\n\n## Affected Systems\n\n- Flyto2 Core\n- **flyto-core**: < 2.26.7 (Fixed in: `2.26.7`)\n\n## Mitigation\n\n- Update flyto-core to version 2.26.7 or newer.\n- Bind port 8344 exclusively to local network interfaces or trusted internal container subnets.\n- Configure the FLYTO_VERIFICATION_API_KEY environment variable to enable token comparison checks.\n- Use FLYTO_TRUSTED_CALLBACK_HOSTS to limit authorized callback endpoints.\n\n**Remediation Steps:**\n1. Identify all deployment instances running flyto-core versions prior to v2.26.7.\n2. Modify deployment configuration files or docker-compose files to pull flyto-core:2.26.7 or higher.\n3. Inject environment variable FLYTO_VERIFICATION_API_KEY with a secure, randomly generated alphanumeric string.\n4. Configure the FLYTO_ENGINE_URL and FLYTO_TRUSTED_CALLBACK_HOSTS environment variables to reflect trusted services.\n5. Deploy network security groups or local firewall rules (iptables/ufw) to drop external traffic attempting to connect to TCP port 8344.\n6. Restart the flyto-verification containers to apply the patched binary and environment configurations.\n\n## References\n\n- [National Vulnerability Database record for CVE-2026-67426](https://nvd.nist.gov/vuln/detail/CVE-2026-67426)\n- [CVE Program Record for CVE-2026-67426](https://www.cve.org/CVERecord?id=CVE-2026-67426)\n- [GitHub Security Advisory (GHSA-jx74-cqjv-2c67)](https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67426) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T20:33:08.589232Z"} https://vulnerability.circl.lu/sighting/ca6ab918-4af3-4511-b4ac-6e848c0635a2/export Thu, 30 Jul 2026 20:33:08 +0000