{"uuid": "1d1b16ce-3273-49db-8b56-cdf4f563b35d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-c9hr-64h3-gxpc", "type": "seen", "source": "https://gist.github.com/alon710/5c4b46a299dac54e7caa99802f7ad9a8", "content": "# CVE-2026-67424: CVE-2026-67424: Server-Side Request Forgery Bypass via Unvalidated Redirects in Flyto2 Core\n\n> **CVSS Score:** 8.5\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67424\n\n## Summary\nAn SSRF vulnerability exists in Flyto2 Core due to improper validation of intermediate HTTP redirect hops. While the initial request target is validated against an SSRF protection policy, the HTTP client library (aiohttp) transparently follows 30x redirects to local, internal, or cloud metadata endpoints without application-level revalidation.\n\n## TL;DR\nFlyto2 Core follows HTTP redirects to private internal subnets without revalidating intermediate URLs, leading to an SSRF vulnerability (CVSS 8.5).\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS Base Score**: 8.5\n- **EPSS Score**: 0.00236\n- **EPSS Percentile**: 14.80%\n- **Exploit Status**: poc\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Flyto2 Core execution kernel (flyto-core)\n- **flyto-core**: < 2.26.7 (Fixed in: `2.26.7`)\n\n## Mitigation\n\n- Upgrade the flyto-core library to version 2.26.7 or newer to enforce hop-by-hop validation.\n- Apply strict firewall egress rules on runner nodes to block outbound requests to private network subnets.\n- Configure cloud instance metadata services (IMDS) to require session tokens (IMDSv2) to mitigate generic, credential-grabbing SSRF attacks.\n\n**Remediation Steps:**\n1. Identify all active deployments running flyto-core versions older than 2.26.7.\n2. Run the pip upgrade command: pip install --upgrade flyto-core>=2.26.7\n3. Validate the configuration of the SSRF guard utility variables within the environment config file.\n4. Restart active execution runner daemons to load the updated validation logic.\n\n## References\n\n- [GHSA-c9hr-64h3-gxpc: Guarded HTTP modules follow redirects into internal space](https://github.com/flytohub/flyto-core/security/advisories/GHSA-c9hr-64h3-gxpc)\n- [Flyto Core Hardening Commit](https://github.com/flytohub/flyto-core/commit/0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9)\n- [NVD - CVE-2026-67424 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-67424)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67424) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T15:31:53.989322Z"}