SSRF Vulnerability in Flyto2 Core Automation for AI-Agent Workflows
CVE-2026-67428

8.5HIGH

Key Information:

Vendor

Flytohub

Status
Flyto-core
Vendor
CVE Published:
29 July 2026

What is CVE-2026-67428?

Flyto2 Core, utilized for automation and AI-agent workflows, contains a vulnerability allowing unauthorized URL access through HTTP-emitting modules. Prior to version 2.26.7, various components, including communication and notification modules, could indeed fetch caller-controlled URLs without proper validation, potentially exposing internal or sensitive metadata endpoints to SSRF attacks. This critical issue has been addressed in the release of version 2.26.7.

Affected Version(s)

flyto-core < 2.26.7

References

https://github.com/flytohub/flyto-core/security/advisorie...
x_refsource_CONFIRM
https://github.com/flytohub/flyto-core/commit/0a0a528520e...
x_refsource_MISC
https://github.com/flytohub/flyto-core/releases/tag/v2.26.7
x_refsource_MISC

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.