{"uuid": "1b4926e1-ab99-4dd4-87a1-b40d126fee7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-jx74-cqjv-2c67", "type": "seen", "source": "https://gist.github.com/alon710/c5ece1b4b71f33d4bb332d0422fd7596", "content": "# CVE-2026-67426: CVE-2026-67426: Unauthenticated Remote Code Execution and Secret Exfiltration in Flyto2 Core\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67426\n\n## Summary\nCVE-2026-67426 is a critical vulnerability in Flyto2 Core prior to version 2.26.7. The standalone flyto-verification service binds to all interfaces (0.0.0.0) on port 8344 and exposes an unauthenticated POST /run endpoint. This endpoint accepts an arbitrary client-controlled callback URL and makes an outbound POST request containing the sensitive internal runner secret in the headers. Attackers can exploit this to retrieve the FLYTO_RUNNER_SECRET and perform Server-Side Request Forgery (SSRF) against internal network targets.\n\n## TL;DR\nThe flyto-verification service exposed an unauthenticated endpoint that sent internal runner secrets to arbitrary callback URLs, facilitating credential exfiltration and SSRF.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-918, CWE-522\n- **Attack Vector**: Network\n- **CVSS Base Score**: 9.3\n- **EPSS Score**: 0.00291 (0.29%)\n- **Exploit Status**: poc\n- **KEV Status**: not listed\n- **Affected Component**: flyto-verification service (port 8344)\n\n## Affected Systems\n\n- Flyto2 Core\n- **flyto-core**: < 2.26.7 (Fixed in: `2.26.7`)\n\n## Mitigation\n\n- Update flyto-core to version 2.26.7 or newer.\n- Bind port 8344 exclusively to local network interfaces or trusted internal container subnets.\n- Configure the FLYTO_VERIFICATION_API_KEY environment variable to enable token comparison checks.\n- Use FLYTO_TRUSTED_CALLBACK_HOSTS to limit authorized callback endpoints.\n\n**Remediation Steps:**\n1. Identify all deployment instances running flyto-core versions prior to v2.26.7.\n2. Modify deployment configuration files or docker-compose files to pull flyto-core:2.26.7 or higher.\n3. Inject environment variable FLYTO_VERIFICATION_API_KEY with a secure, randomly generated alphanumeric string.\n4. Configure the FLYTO_ENGINE_URL and FLYTO_TRUSTED_CALLBACK_HOSTS environment variables to reflect trusted services.\n5. Deploy network security groups or local firewall rules (iptables/ufw) to drop external traffic attempting to connect to TCP port 8344.\n6. Restart the flyto-verification containers to apply the patched binary and environment configurations.\n\n## References\n\n- [National Vulnerability Database record for CVE-2026-67426](https://nvd.nist.gov/vuln/detail/CVE-2026-67426)\n- [CVE Program Record for CVE-2026-67426](https://www.cve.org/CVERecord?id=CVE-2026-67426)\n- [GitHub Security Advisory (GHSA-jx74-cqjv-2c67)](https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67426) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T20:33:08.630533Z"}