https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 01 Aug 2026 18:35:37 +0000 https://vulnerability.circl.lu/sighting/ca6ab918-4af3-4511-b4ac-6e848c0635a2/export {"uuid": "ca6ab918-4af3-4511-b4ac-6e848c0635a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67426", "type": "seen", "source": "https://gist.github.com/alon710/c5ece1b4b71f33d4bb332d0422fd7596", "content": "# CVE-2026-67426: CVE-2026-67426: Unauthenticated Remote Code Execution and Secret Exfiltration in Flyto2 Core\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67426\n\n## Summary\nCVE-2026-67426 is a critical vulnerability in Flyto2 Core prior to version 2.26.7. The standalone flyto-verification service binds to all interfaces (0.0.0.0) on port 8344 and exposes an unauthenticated POST /run endpoint. This endpoint accepts an arbitrary client-controlled callback URL and makes an outbound POST request containing the sensitive internal runner secret in the headers. Attackers can exploit this to retrieve the FLYTO_RUNNER_SECRET and perform Server-Side Request Forgery (SSRF) against internal network targets.\n\n## TL;DR\nThe flyto-verification service exposed an unauthenticated endpoint that sent internal runner secrets to arbitrary callback URLs, facilitating credential exfiltration and SSRF.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-918, CWE-522\n- **Attack Vector**: Network\n- **CVSS Base Score**: 9.3\n- **EPSS Score**: 0.00291 (0.29%)\n- **Exploit Status**: poc\n- **KEV Status**: not listed\n- **Affected Component**: flyto-verification service (port 8344)\n\n## Affected Systems\n\n- Flyto2 Core\n- **flyto-core**: < 2.26.7 (Fixed in: `2.26.7`)\n\n## Mitigation\n\n- Update flyto-core to version 2.26.7 or newer.\n- Bind port 8344 exclusively to local network interfaces or trusted internal container subnets.\n- Configure the FLYTO_VERIFICATION_API_KEY environment variable to enable token comparison checks.\n- Use FLYTO_TRUSTED_CALLBACK_HOSTS to limit authorized callback endpoints.\n\n**Remediation Steps:**\n1. Identify all deployment instances running flyto-core versions prior to v2.26.7.\n2. Modify deployment configuration files or docker-compose files to pull flyto-core:2.26.7 or higher.\n3. Inject environment variable FLYTO_VERIFICATION_API_KEY with a secure, randomly generated alphanumeric string.\n4. Configure the FLYTO_ENGINE_URL and FLYTO_TRUSTED_CALLBACK_HOSTS environment variables to reflect trusted services.\n5. Deploy network security groups or local firewall rules (iptables/ufw) to drop external traffic attempting to connect to TCP port 8344.\n6. Restart the flyto-verification containers to apply the patched binary and environment configurations.\n\n## References\n\n- [National Vulnerability Database record for CVE-2026-67426](https://nvd.nist.gov/vuln/detail/CVE-2026-67426)\n- [CVE Program Record for CVE-2026-67426](https://www.cve.org/CVERecord?id=CVE-2026-67426)\n- [GitHub Security Advisory (GHSA-jx74-cqjv-2c67)](https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67426) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T20:33:08.589232Z"} {"uuid": "ca6ab918-4af3-4511-b4ac-6e848c0635a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67426", "type": "seen", "source": "https://gist.github.com/alon710/c5ece1b4b71f33d4bb332d0422fd7596", "content": "# CVE-2026-67426: CVE-2026-67426: Unauthenticated Remote Code Execution and Secret Exfiltration in Flyto2 Core\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67426\n\n## Summary\nCVE-2026-67426 is a critical vulnerability in Flyto2 Core prior to version 2.26.7. The standalone flyto-verification service binds to all interfaces (0.0.0.0) on port 8344 and exposes an unauthenticated POST /run endpoint. This endpoint accepts an arbitrary client-controlled callback URL and makes an outbound POST request containing the sensitive internal runner secret in the headers. Attackers can exploit this to retrieve the FLYTO_RUNNER_SECRET and perform Server-Side Request Forgery (SSRF) against internal network targets.\n\n## TL;DR\nThe flyto-verification service exposed an unauthenticated endpoint that sent internal runner secrets to arbitrary callback URLs, facilitating credential exfiltration and SSRF.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-918, CWE-522\n- **Attack Vector**: Network\n- **CVSS Base Score**: 9.3\n- **EPSS Score**: 0.00291 (0.29%)\n- **Exploit Status**: poc\n- **KEV Status**: not listed\n- **Affected Component**: flyto-verification service (port 8344)\n\n## Affected Systems\n\n- Flyto2 Core\n- **flyto-core**: < 2.26.7 (Fixed in: `2.26.7`)\n\n## Mitigation\n\n- Update flyto-core to version 2.26.7 or newer.\n- Bind port 8344 exclusively to local network interfaces or trusted internal container subnets.\n- Configure the FLYTO_VERIFICATION_API_KEY environment variable to enable token comparison checks.\n- Use FLYTO_TRUSTED_CALLBACK_HOSTS to limit authorized callback endpoints.\n\n**Remediation Steps:**\n1. Identify all deployment instances running flyto-core versions prior to v2.26.7.\n2. Modify deployment configuration files or docker-compose files to pull flyto-core:2.26.7 or higher.\n3. Inject environment variable FLYTO_VERIFICATION_API_KEY with a secure, randomly generated alphanumeric string.\n4. Configure the FLYTO_ENGINE_URL and FLYTO_TRUSTED_CALLBACK_HOSTS environment variables to reflect trusted services.\n5. Deploy network security groups or local firewall rules (iptables/ufw) to drop external traffic attempting to connect to TCP port 8344.\n6. Restart the flyto-verification containers to apply the patched binary and environment configurations.\n\n## References\n\n- [National Vulnerability Database record for CVE-2026-67426](https://nvd.nist.gov/vuln/detail/CVE-2026-67426)\n- [CVE Program Record for CVE-2026-67426](https://www.cve.org/CVERecord?id=CVE-2026-67426)\n- [GitHub Security Advisory (GHSA-jx74-cqjv-2c67)](https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67426) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T20:33:08.589232Z"} https://vulnerability.circl.lu/sighting/ca6ab918-4af3-4511-b4ac-6e848c0635a2/export Thu, 30 Jul 2026 20:33:08 +0000 https://vulnerability.circl.lu/sighting/bf9e7eaf-55a2-4d7f-9099-08bcdb201581/export {"uuid": "bf9e7eaf-55a2-4d7f-9099-08bcdb201581", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67426", "type": "published-proof-of-concept", "source": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67", "content": "", "creation_timestamp": "2026-07-30T16:35:07.996589Z"} {"uuid": "bf9e7eaf-55a2-4d7f-9099-08bcdb201581", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67426", "type": "published-proof-of-concept", "source": "https://github.com/flytohub/flyto-core/security/advisories/GHSA-jx74-cqjv-2c67", "content": "", "creation_timestamp": "2026-07-30T16:35:07.996589Z"} https://vulnerability.circl.lu/sighting/bf9e7eaf-55a2-4d7f-9099-08bcdb201581/export Thu, 30 Jul 2026 16:35:07 +0000 https://vulnerability.circl.lu/sighting/7fafa28f-e803-4c48-b7f4-b7e2bab58e9c/export {"uuid": "7fafa28f-e803-4c48-b7f4-b7e2bab58e9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67426", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mrt66ra3h62g", "content": "Unauthenticated SSRF Turns Flyto2 Into A Secret-Leaking Confessional\nPANIC 88% | Lag 0.0h | CVE-2026-67426 is a critical SSRF in Flyto2 Core. The unauthenticated /run endpoint can exfiltrate r\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-07-30T00:20:19.655037Z"} {"uuid": "7fafa28f-e803-4c48-b7f4-b7e2bab58e9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67426", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mrt66ra3h62g", "content": "Unauthenticated SSRF Turns Flyto2 Into A Secret-Leaking Confessional\nPANIC 88% | Lag 0.0h | CVE-2026-67426 is a critical SSRF in Flyto2 Core. The unauthenticated /run endpoint can exfiltrate r\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-07-30T00:20:19.655037Z"} https://vulnerability.circl.lu/sighting/7fafa28f-e803-4c48-b7f4-b7e2bab58e9c/export Thu, 30 Jul 2026 00:20:19 +0000 https://vulnerability.circl.lu/sighting/6ddb2cca-01da-478d-9314-f6f596e19166/export {"uuid": "6ddb2cca-01da-478d-9314-f6f596e19166", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67426", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mrt25heosm2u", "content": "CVE-2026-67426 - Critical SSRF in Flyto2 Core. Unauthenticated /run endpoint allows runner secret exfiltration. CVSS 9.3. Update to 2.26.7 immediately. #CVE #infosec #Flyto2\n\nhttps://www.valtersit.com/cve/CVE-2026-67426/", "creation_timestamp": "2026-07-29T23:08:00.842957Z"} {"uuid": "6ddb2cca-01da-478d-9314-f6f596e19166", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67426", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mrt25heosm2u", "content": "CVE-2026-67426 - Critical SSRF in Flyto2 Core. Unauthenticated /run endpoint allows runner secret exfiltration. CVSS 9.3. Update to 2.26.7 immediately. #CVE #infosec #Flyto2\n\nhttps://www.valtersit.com/cve/CVE-2026-67426/", "creation_timestamp": "2026-07-29T23:08:00.842957Z"} https://vulnerability.circl.lu/sighting/6ddb2cca-01da-478d-9314-f6f596e19166/export Wed, 29 Jul 2026 23:08:00 +0000 https://vulnerability.circl.lu/sighting/c954dc1c-a876-4e81-9e97-ac10f793a051/export {"uuid": "c954dc1c-a876-4e81-9e97-ac10f793a051", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67426", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrsoxxxgxn2i", "content": "CVE-2026-67426 - flyto-core\nAn outdated version of Flyto2 Core allows unauthorized access to internal data, potentially exposing sensitive information. This issue is fixed in version 2.26.7, so update to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#flytocore #flytohub #CVE #infosec", "creation_timestamp": "2026-07-29T19:48:05.685807Z"} {"uuid": "c954dc1c-a876-4e81-9e97-ac10f793a051", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67426", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrsoxxxgxn2i", "content": "CVE-2026-67426 - flyto-core\nAn outdated version of Flyto2 Core allows unauthorized access to internal data, potentially exposing sensitive information. This issue is fixed in version 2.26.7, so update to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#flytocore #flytohub #CVE #infosec", "creation_timestamp": "2026-07-29T19:48:05.685807Z"} https://vulnerability.circl.lu/sighting/c954dc1c-a876-4e81-9e97-ac10f793a051/export Wed, 29 Jul 2026 19:48:05 +0000