flyteorg vulnerabilities

Products

• github.com/flyteorg/flyteadmin 3
• flyteconsole 1
• github.com/flyteorg/flyte/v2 1

Latest flyteorg CVEs

Newest publication first

1. CVE-2026-108728 Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook

   Published 2026-10-11

   High·CVSS 7.1 EPSS 0.23%

   Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SEC...

2. CVE-2023-41891 FlyteAdmin SQL Injection in List Filters

   Published 2023-10-30

   High·CVSS 8.8 EPSS 1.1%

   FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list fil...

3. CVE-2022-39273 Default OAuth Authorization Server secret in FlyteAdmin

   Published 2022-10-06

   High·CVSS 7.5 EPSS 0.93%

   FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the public internet. In an effort to make enabling authentication easier for Flyte adm...

4. CVE-2022-31145 Insufficient AccessToken Expiration Check in FlyteAdmin

   Published 2022-07-13

   Medium·CVSS 6.5 EPSS 1.1%

   FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Users w...

5. CVE-2022-24856 Server-Side Request Forgery in FlyteConsole

   Published 2022-05-17

   High·CVSS 7.5 EPSS 10.5%

   FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSRF) when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the inter...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.