CVE-2026-67426: CWE-306: Missing Authentication for Critical Function in flytohub flyto-core
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url for an outbound POST with X-Internal-Key: $FLYTO_RUNNER_SECRET while bypassing target_allowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7.
AI Analysis
Technical Summary
The vulnerability in flyto-core (CVE-2026-67426) arises from missing authentication on the POST /run endpoint of the flyto-verification service, which listens on 0.0.0.0:8344. This endpoint accepts unauthenticated requests and uses a client-supplied callback_url to send an outbound POST request containing the X-Internal-Key header with the runner secret. The service bypasses the target_allowed check, enabling attackers to exploit SSRF and extract the secret key. This security flaw is addressed in flyto-core version 2.26.7.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to perform SSRF attacks and exfiltrate the sensitive runner secret (X-Internal-Key). This compromises confidentiality (high impact) and integrity (low impact) of the system, but does not affect availability. The CVSS 3.1 base score is 9.3 (critical), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and scope change.
Mitigation Recommendations
A fix is available in flyto-core version 2.26.7. Users should upgrade to version 2.26.7 or later to remediate this vulnerability. No other official remediation or temporary fixes are indicated. Until patched, restricting network access to the vulnerable service may reduce exposure.
CVE-2026-67426: CWE-306: Missing Authentication for Critical Function in flytohub flyto-core
Description
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url for an outbound POST with X-Internal-Key: $FLYTO_RUNNER_SECRET while bypassing target_allowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7.
CVSS v3.1
Score 9.3critical
Affected software
pkg:github/flytohub/flyto-coreRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in flyto-core (CVE-2026-67426) arises from missing authentication on the POST /run endpoint of the flyto-verification service, which listens on 0.0.0.0:8344. This endpoint accepts unauthenticated requests and uses a client-supplied callback_url to send an outbound POST request containing the X-Internal-Key header with the runner secret. The service bypasses the target_allowed check, enabling attackers to exploit SSRF and extract the secret key. This security flaw is addressed in flyto-core version 2.26.7.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to perform SSRF attacks and exfiltrate the sensitive runner secret (X-Internal-Key). This compromises confidentiality (high impact) and integrity (low impact) of the system, but does not affect availability. The CVSS 3.1 base score is 9.3 (critical), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and scope change.
Mitigation Recommendations
A fix is available in flyto-core version 2.26.7. Users should upgrade to version 2.26.7 or later to remediate this vulnerability. No other official remediation or temporary fixes are indicated. Until patched, restricting network access to the vulnerable service may reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-29T15:02:20.413Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6a4bfc9c2644c7f8e93eca
Added to database: 07/29/2026, 18:52:44 UTC
Last enriched: 07/29/2026, 19:09:40 UTC
Last updated: 07/29/2026, 19:23:01 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.