CVE-2026-67426
Flyto2 Core, an automation and AI‑agent workflow engine, had a flaw before version 2.26.7 that let anyone send a POST request to /run on port 8344. The service would then forward that request to a user‑supplied URL, exposing the server to unauthenticated Server‑Side Request Forgery (SSRF) and leaking a secret key.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Flyto2 Core users running any version earlier than 2.26.7, typically developers or system administrators who host the service.
Real-world impact
An attacker could trigger the server to make arbitrary HTTP requests to internal or external systems and capture the runner secret, which could be used to gain further access or control over the environment.
Why this severity
The CVSS score of 9.3 reflects a network‑based attack that requires no privileges or user interaction, has low complexity, and can fully compromise confidentiality by exposing a secret key. Integrity is only partially affected and availability is not impacted.
What to do about it
- 01Upgrade Flyto2 Core to version 2.26.7 or later.
- 02Restart the Flyto2 Core service to apply the update.
NVD-referenced vendor advisory
Timeline
- Jul 29, 2026 · 16h agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 15h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.