CVE-2026-67429
Flyto2 Core, an automation and AI‑agent workflow engine, had a flaw that let attackers write files anywhere the process could access. The vulnerability existed in all versions before 2.26.6 and was fixed in that release. It allows an attacker to place arbitrary files on the system.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Flyto2 Core users running any version earlier than 2.26.6. This includes developers and operators who rely on the image.download and related file‑writing modules.
Real-world impact
An attacker could create or overwrite files on the host, potentially installing malicious code, tampering with configuration, or causing a denial of service by corrupting critical files.
Why this severity
The CVSS score of 10 reflects that no authentication or user interaction is required, yet the flaw lets an attacker modify any file the process can write to, compromising integrity and availability. Confidentiality is not affected because the attacker cannot read data.
What to do about it
- 01Upgrade Flyto2 Core to version 2.26.6 or later.
NVD-referenced vendor advisory
Timeline
- Jul 29, 2026 · 16h agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 15h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.