Flyto-core versions before 2.26.6 contain a vulnerability where the llm.chat module reads sensitive environment variables containing provider API keys and includes them in the Authorization: Bearer header when making requests to a base_url controlled by the caller. This behavior allows an attacker to receive these sensitive keys if they can direct requests to a public host that circumvents the server-side request forgery (SSRF) guard. The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data) and CWE-522 (Insufficiently Protected Credentials). The issue is resolved in flyto-core version 2.26.6.

An attacker who can control the base_url parameter and direct requests to a public host that bypasses SSRF protections can obtain sensitive API keys (e.g., OPENAI_API_KEY, ANTHROPIC_API_KEY) from the environment. This exposure can lead to unauthorized use of these keys, potentially resulting in data breaches or abuse of the associated AI services. The vulnerability does not affect integrity or availability directly but results in a high confidentiality impact.

This vulnerability is fixed in flyto-core version 2.26.6. Users should upgrade to version 2.26.6 or later to remediate this issue. Since no official remediation level or patch link is provided beyond this version information, confirm with the vendor advisory for the latest patch status. Until upgraded, avoid using untrusted input for the base_url parameter or restrict network access to trusted hosts to reduce exposure.