CVE-2026-67426

Katalog CVE

CVSS 9.3 · Critical EPSS 0,51%

Kerentanan Missing Authentication for Critical Function. Skor CVSS 3.1 9.3 (Critical) menurut github.com.

Deskripsi (NVD)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url for an outbound POST with X-Internal-Key: $FLYTO_RUNNER_SECRET while bypassing target_allowed, allowing unauthenticated SSRF and runner secret exfiltration. This issue is fixed in version 2.26.7.

Rincian

Terbit di NVD

29 Juli 2026

Terakhir diubah

30 Juli 2026

Status NVD

Deferred

CVSS 3.1

9.3 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-522: Insufficiently Protected Credentials
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9
• https://github.com/flytohub/flyto-core/releases/tag/v2.26.7
• https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67